Vendor
Freedesktop vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 15 vulnerabilities in Freedesktop: 1 in the last 7 days and 9 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120749, was published on 6 November 2026. 4 vulnerabilities in the last four weeks, down 20% on the four before (5).
- Last 7 days
- 1
- Last 90 days
- 9
- Critical, all time
- 1
- Exploited in the wild
- 0
About Freedesktop
Freedesktop is an organization that maintains specifications and standards for interoperability in open-source desktop environments.
Latest Freedesktop vulnerabilities
- CVE-2026-120749: D-Bus daemon denial of service via monitored broadcast message failuremediumCVSS 6.2
- CVE-2026-120830: libslirp out-of-bounds heap read in icmp_forward_error()highCVSS 7.4
- CVE-2026-109088: libXtst infinite loop in RECORD EnableContext reply parsingmediumCVSS 6.5
- CVE-2026-112271: libdisplay-info heap out-of-bounds read in DisplayID parsermediumCVSS 5.5
- CVE-2026-107705: Poppler stack-based buffer overflow in Decrypt::revision6Hash()mediumCVSS 6.5EPSS 0.3%
- CVE-2026-94287: libXpm unsigned integer underflow in write pathmediumCVSS 5.5
- CVE-2026-94286: libXtst out-of-bounds read in RECORD reply parserhighCVSS 7.1
- CVE-2026-94282: libXi out-of-bounds read in XI2 enter/leave/focus event parsingmediumCVSS 5.6
- CVE-2026-96808: Flatpak revokefs symlink path traversal privilege escalationhighCVSS 7.4EPSS 0.1%
- CVE-2026-35094: A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can…lowCVSS 3.3EPSS 0.1%
- CVE-2026-4897: A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to…mediumCVSS 5.5EPSS 0.2%
- CVE-2026-1940: An incomplete fix for allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation cmediumCVSS 5.1EPSS 0.2%
- CVE-2026-26104: A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption…mediumCVSS 5.5EPSS 0.1%
- CVE-2026-26103: udisks missing authorization in LUKS header restoration APIhighCVSS 7.1EPSS 0.1%
- CVE-2016-2090: freedesktop libbsd heap buffer overflow in fgetwlncriticalCVSS 9.8
Most severe Freedesktop vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2016-2090: freedesktop libbsd heap buffer overflow in fgetwlncriticalCVSS 9.8
- CVE-2026-96808: Flatpak revokefs symlink path traversal privilege escalationhighCVSS 7.4EPSS 0.1%
- CVE-2026-120830: libslirp out-of-bounds heap read in icmp_forward_error()highCVSS 7.4
- CVE-2026-26103: udisks missing authorization in LUKS header restoration APIhighCVSS 7.1EPSS 0.1%
- CVE-2026-94286: libXtst out-of-bounds read in RECORD reply parserhighCVSS 7.1
- CVE-2026-107705: Poppler stack-based buffer overflow in Decrypt::revision6Hash()mediumCVSS 6.5EPSS 0.3%
- CVE-2026-109088: libXtst infinite loop in RECORD EnableContext reply parsingmediumCVSS 6.5
- CVE-2026-120749: D-Bus daemon denial of service via monitored broadcast message failuremediumCVSS 6.2
- CVE-2026-94282: libXi out-of-bounds read in XI2 enter/leave/focus event parsingmediumCVSS 5.6
- CVE-2026-4897: A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to…mediumCVSS 5.5EPSS 0.2%
Vulnerabilities per week
4 vulnerabilities in the last four weeks, down 20% on the four before (5). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 1 | 0 | |
| 28 Sep 2026 | 3 | 0 | |
| 5 Oct 2026 | 1 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 1 | 0 | |
| 26 Oct 2026 | 1 | 0 | |
| 2 Nov 2026 | 2 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Freedesktop vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/freedesktop)<a href="https://junglewise.ai/threats/vendors/freedesktop"><img src="https://junglewise.ai/threats/vendors/freedesktop/badge.svg" alt="Freedesktop vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/freedesktop.json, and this page as text at https://junglewise.ai/threats/vendors/freedesktop.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Freedesktop vulnerabilities", https://junglewise.ai/threats/vendors/freedesktop, 10 November 2026.