GNU

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any GNU product.

RSS Feeds for GNU security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in GNU products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by GNU Sorted by Most Security Vulnerabilities since 2018

GNU Binutils154 vulnerabilities

GNU Glibc106 vulnerabilities

GNU Libredwg94 vulnerabilities

GNU Grub252 vulnerabilities

Gnutls30 vulnerabilities

GNU Ncurses27 vulnerabilities

GNU Grub23 vulnerabilities

GNU Mailman19 vulnerabilities

GNU Emacs19 vulnerabilities

GNU Wget14 vulnerabilities

GNU Tar14 vulnerabilities

GNU Pspp12 vulnerabilities

GNU Gcc11 vulnerabilities

GNU Screen10 vulnerabilities

GNU Patch10 vulnerabilities

GNU Inetutils9 vulnerabilities

GNU Cpio8 vulnerabilities

GNU Cflow6 vulnerabilities

GNU Gzip6 vulnerabilities

GNU Coreutils6 vulnerabilities

GNU Org Mode5 vulnerabilities

GNU Libidn5 vulnerabilities

GNU Nano4 vulnerabilities

Gnu Sasl3 vulnerabilities

GNU Guix3 vulnerabilities

GNU Indent2 vulnerabilities

GNU Less2 vulnerabilities

GNU Savane2 vulnerabilities

GNU Cvs1 vulnerability

GNU Libiberty1 vulnerability

GNU Libcdio1 vulnerability

GNU Grub 21 vulnerability

Known Exploited GNU Vulnerabilities

The following GNU vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
GNU InetUtils Argument Injection Vulnerability	GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable. CVE-2026-24061 Exploit Probability: 97.9%	January 26, 2026
GNU Bash OS Command Injection Vulnerability	GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment. CVE-2014-6278 Exploit Probability: 99.6%	October 2, 2025
GNU C Library Buffer Overflow Vulnerability	GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges. CVE-2023-4911 Exploit Probability: 81.4%	November 21, 2023
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability	GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. CVE-2014-6271 Exploit Probability: 100.0%	January 28, 2022
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability	GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271. CVE-2014-7169 Exploit Probability: 99.9%	January 28, 2022

Of the known exploited vulnerabilities above, 5 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 71 vulnerabilities in GNU with an average score of 5.7 out of ten. Last year, in 2025 GNU had 92 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in GNU in 2026 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.30.

Year	Vulnerabilities	Average Score
2026	71	5.69
2025	92	5.39
2024	33	6.83
2023	78	6.93
2022	51	7.18
2021	87	7.24
2020	54	6.38
2019	83	7.18
2018	77	6.54

It may take a day or so for new GNU vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent GNU Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-6791	Aug 10, 2026	glibc wordexp Stack Clash via Large Tilde Username When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.	Glibc
CVE-2026-6368	Aug 10, 2026	glibc <=2.43 wordexp WRDE_APPEND Return Invalid Memory Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.	Glibc
CVE-2026-66486	Aug 10, 2026	GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30	Cpio
CVE-2026-66485	Aug 10, 2026	GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9	Cpio
CVE-2026-66484	Aug 10, 2026	GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files. This issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad	Cpio
CVE-2026-71394	Aug 10, 2026	GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a struct with uninitialized heap memory in the table directory entries. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This leads to the use of uninitialized heap data in subsequent table lookups, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets. This issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf	Emacs
CVE-2026-71393	Aug 10, 2026	GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType font file without overflow checking. On 32-bit targets, a crafted font causes the calculation to wrap, resulting in an undersized heap allocation. A subsequent read() call writes beyond the buffer, causing a heap buffer overflow. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This can lead to heap memory corruption and potential code execution. This issue was fixed in commit d51a4722316efe0960994d371e1859099894d1ca	Emacs
CVE-2026-71392	Aug 10, 2026	GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the xmalloc allocation call wraps around on 32-bit builds, causing a heap buffer overflow write. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This results in heap memory corruption that can lead to code execution. This issue was fixed in commit c4e20777c26548722a37b03db93243e83a0d6188	Emacs
CVE-2026-71391	Aug 10, 2026	GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This exposes heap memory contents which can be later used to defeat ASLR. This issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe	Emacs
CVE-2026-56390	Jul 29, 2026	GNU Bison <=3.8.2 Local File Overwrite via %output/%header GNU Bison improperly handles grammardefined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override callersupplied output options. When processing attacker-supplied grammar, this behavior allows directing generated files to arbitrary writable locations on the filesystem, potentially overwriting existing files accessible to the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 8d101c19d4d9aaedf83a448c925513742d4efcf0. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
CVE-2026-56389	Jul 29, 2026	GNU Bison <3.8.2 Arbitrary Code Exec via %define tool.xsltproc GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XMLtoHTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
CVE-2026-56392	Jul 24, 2026	GNU coreutils unexpand: Heap Buffer Overflow via Large -t Tab Stop GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted input, subsequent writes exceed the allocated memory, leading to an outofbounds heap write. When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout. This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d	Coreutils
CVE-2026-56391	Jul 24, 2026	OOB Read in GNU coreutils uniq via -w option GNU coreutils uniq is vulnerable to an outofbounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input. When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure. This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.	Coreutils
CVE-2026-53910	Jul 22, 2026	Diffutils diff3 Heap Buffer Overflow via Signed Integer Overflows diff3 tool from GNU diffutils is vulnerable to a heapbased buffer overflow due to multiple signed integer overflows in linemapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform outofbounds writes during internal processing. An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815 NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.
CVE-2026-40553	Jul 13, 2026	gawk <5.4.0 Buffer Overflow (ftype) Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.
CVE-2026-40469	Jul 13, 2026	Integer Overflow in Builtin.c of gawk 5.4.0 (32bit) Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.
CVE-2026-40468	Jul 13, 2026	gawk Integer Overflow in builtin.c (<=5.4.0) Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.
CVE-2026-40467	Jul 13, 2026	Gawk Use After Free in io.c (do_getline_redir) - Before 5.4.0 Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.
CVE-2026-15520	Jul 13, 2026	LibreDWG 0.13.4 R2004 Decompression Buffer Overflow (before 0.14.8396) A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompress_R2004_section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.14.8396 will fix this issue. This patch is called 3d0f9fc2eddbd6579c99af3111c37c98f03475d0. You should upgrade the affected component.	Libredwg
CVE-2026-15146	Jul 10, 2026	SSRF via Unvalidated FTP PASV IP in GNU Wget <1.25.0 GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wgets data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.	Wget
CVE-2026-15184	Jul 09, 2026	Nullptr Deref in LibreDWG DWG Handler (0.13.4) Local Exploit A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.	Libredwg
CVE-2026-15182	Jul 09, 2026	Heap Overflow in LibreDWG 0.13.4 BMP Image Handler A vulnerability has been found in GNU LibreDWG up to 0.13.4. The affected element is the function dwg_bmp of the file src/dwg.c of the component BMP Image Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.14 is sufficient to fix this issue. The name of the patch is 18fd542bb4d5ccedf9de12052bf50068b2b26f06. It is suggested to upgrade the affected component.	Libredwg
CVE-2026-56289	Jul 09, 2026	DoS in GNU Patch via Unrealistic Hunk Offsets GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position. This results in excessive CPU consumption and prevents the process from completing. An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination. This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9	Patch
CVE-2026-56288	Jul 09, 2026	Null Pointer Dereference in GNU Patch (CVE-2026-56288) GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing. An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service. This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f722313	Patch
CVE-2026-58472	Jul 07, 2026	Heap Buffer Overflow in GNU Wget 1.25.0 html_quote_string() (convert.c) GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.	Wget
CVE-2026-58471	Jul 07, 2026	GNU Wget 1.25.0 Heap Buffer Overflow (convert_fname) GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response.	Wget
CVE-2026-58470	Jul 07, 2026	Wget 1.25.0 Integer Overflow in parse_content_range() GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.	Wget
CVE-2026-58469	Jul 07, 2026	GNU Wget <1.25.0 Heap Buffer Underread in clean_metalink_string GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.	Wget
CVE-2026-41992	Jun 29, 2026	GNU gzip LZH buffer overflow via global state reuse GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an outofbounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer. This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681	Gzip
CVE-2026-41991	Jun 29, 2026	GNU gzip gzexe TOCTOU File Overwrite via Symlink GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the users PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can precreate the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a timeofcheck to timeofuse (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269	Gzip
CVE-2026-57053	Jun 23, 2026	GNU libidn <1.44 OOB Read in ToUnicode API GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.	Libidn
CVE-2026-56968	Jun 23, 2026	GNU SASL <2.2.4 NTLM Challenge Sanitization Flaw (Memory Disclosure) GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.	Gnu Sasl
CVE-2026-56355	Jun 20, 2026	Auth Bypass via Untrusted Data in Savane <=3.17 (CVE-2026-56355) GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.	Savane
CVE-2026-9605	May 26, 2026	Heap Buffer Overflow in GNU libredwg 0.13.4.8160 (Dwgbmp Utility) A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 8f03865f37f5d4ffd616fef802acc980be54d300. Applying a patch is the recommended action to fix this issue.	Libredwg
CVE-2026-9530	May 26, 2026	OOB Read in GNU LibreDWG (pre-0.14) Dwgbmp Utility A weakness has been identified in GNU LibreDWG up to 0.14. The impacted element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgbmp Utility. Executing a manipulation can lead to out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8f03865f37f5d4ffd616fef802acc980be54d300. It is advisable to implement a patch to correct this issue.	Libredwg
CVE-2026-9529	May 26, 2026	Local Null Dereference in LibreDWG<0.14 match_BLOCK_HEADER (Dwggrep) A security flaw has been discovered in GNU LibreDWG up to 0.14. The affected element is the function match_BLOCK_HEADER of the file dwggrep.c of the component Dwggrep Utility. Performing a manipulation results in null pointer dereference. The attack requires a local approach. The exploit has been released to the public and may be used for attacks.	Libredwg
CVE-2026-9504	May 25, 2026	LibreDWG <=0.14 OOBR in Dwggrep::bit_convert_TU A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue.	Libredwg
CVE-2026-9503	May 25, 2026	LibreDWG 0.14 Null Deref in dwg_next_entity (Local) A security flaw has been discovered in GNU LibreDWG up to 0.14. This impacts the function dwg_next_entity of the file src/decode.c of the component DWG File Handler. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as 8f03865f37f5d4ffd616fef802acc980be54d300. Upgrading the affected component is advised.	Libredwg
CVE-2026-9502	May 25, 2026	Heap Buffer Overflow in GNU LibreDWG Dwgread <=0.14 A vulnerability was identified in GNU LibreDWG up to 0.14. This affects the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is e501cb9926c1e9a07a0d1cc997f3e69e9be801c9. To fix this issue, it is recommended to deploy a patch.	Libredwg
CVE-2026-9501	May 25, 2026	LibreDWG <=0.14 DEP Assertion via decompress_R2004_section Local Only A vulnerability was determined in GNU LibreDWG up to 0.14. The impacted element is the function decompress_R2004_section of the file src/decode.c of the component Dwgread Utility. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called e501cb9926c1e9a07a0d1cc997f3e69e9be801c9. A patch should be applied to remediate this issue.	Libredwg
CVE-2026-9500	May 25, 2026	LibreDWG<=0.14: heap-based buffer overflow in read_2004_compressed_section A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read_2004_compressed_section of the file src/decode.c of the component Dwgread Utility. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.	Libredwg
CVE-2026-48829	May 24, 2026	GNU SASL <2.2.3 Null Pointer Deref in DIGEST-MD5 Component In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.	Gnu Sasl
CVE-2026-1858	Apr 29, 2026	wget2 TLS Cert Validation Bypass: Key Usage/EKU Mismatch wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.	Wget
CVE-2026-6238	Apr 28, 2026	glibc 2.2+ RDATA len validate flaw in deprec DNS funcs The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.	Glibc
CVE-2026-40556	Apr 28, 2026	GNU nano <9.0: worldwritable ~/.local created by 0777 mode	Nano
CVE-2026-5435	Apr 28, 2026	glibc v2.2+ OOB Write via Deprecated DNS Print Functions The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.	Glibc
CVE-2026-5450	Apr 20, 2026	glibc 2.7-2.43 %mc scanf causes 1byte heap overflow Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.	Glibc
CVE-2026-5928	Apr 20, 2026	glibc <=2.43 ungetwc Buffer Under-Read via _IO_wdefault_pbackfail Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.	Glibc
CVE-2026-5958	Apr 20, 2026	sed 4.9-: In-Place Edit + --follow-symlinks Race -> Arbitrary File Overwrite (CVE-2026-5958) When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: 1. resolves symlink to its target and stores the resolved path for determining when output is written, 2. opens the original symlink path (not the resolved one) to read the file. Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process. This issue was fixed in version 4.10.
CVE-2026-4046	Mar 30, 2026	Crash via iconv() in glibc <=2.43 with IBM139x charsets The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.	Glibc