# Gnome vulnerabilities Source: https://junglewise.ai/threats/vendors/gnome Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/gnome.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 122 vulnerabilities in Gnome: 0 in the last 7 days and 47 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120194, was published on 31 October 2026. 13 vulnerabilities in the last four weeks, down 28% on the four before (18). 9 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 12 - Last 90 days: 47 - All time: 122 (1 critical, 0 exploited in the wild) ## About Gnome GNOME is a free and open-source desktop environment for Unix-like operating systems. ## Latest Gnome vulnerabilities - [CVE-2026-120194: json-glib infinite loop in JSONPath slice evaluator](https://junglewise.ai/threats/cve-2026-120194-a-flaw-was-found-in-json-glib-the-jsonpath-slice-evaluator-used) (high, CVSS 7.5, published 31 Oct 2026) - [CVE-2026-118599: Epiphany file overwrite in WebExtension installer](https://junglewise.ai/threats/cve-2026-118599-a-file-overwrite-vulnerability-exists-in-epiphany-when) (medium, CVSS 5.5, published 31 Oct 2026) - [CVE-2026-118598: GNOME Epiphany logic error in site permission handling](https://junglewise.ai/threats/cve-2026-118598-a-logic-error-in-epiphany-s-site-permission-handling-can-cause) (medium, CVSS 6.5, published 31 Oct 2026) - [CVE-2026-119528: GIMP stack buffer overflow in PSD image resource header loader](https://junglewise.ai/threats/cve-2026-119528-a-flaw-was-found-in-gimp-the-psd-plug-in-s-image-resource-header) (high, CVSS 7.8, published 30 Oct 2026) - [CVE-2026-115683: GNOME Epiphany TLS certificate warning bypass via race condition](https://junglewise.ai/threats/cve-2026-115683-a-race-condition-in-epiphany-allows-a-malicious-website-to) (medium, CVSS 6.8, published 30 Oct 2026) - [CVE-2026-103963: glib-networking unbounded memory consumption in TLS 1.3](https://junglewise.ai/threats/cve-2026-103963-a-flaw-was-found-in-glib-networking-when-establishing) (high, CVSS 7.5, published 30 Oct 2026) - [CVE-2026-116124: GNOME libgsf heap buffer overflow in OLE2 parser](https://junglewise.ai/threats/cve-2026-116124-a-security-vulnerability-has-been-detected-in-gnome-libgsf-up-to) (medium, CVSS 6.3, published 26 Oct 2026) - [CVE-2026-92183: GIMP stack-based buffer overflow in APNG file parsing](https://junglewise.ai/threats/cve-2026-92183-gimp-apng-file-parsing-stack-based-buffer-overflow-remote-code) (high, CVSS 7.8, published 21 Oct 2026) - [CVE-2026-111802: GNOME Nautilus arbitrary file deletion via trash symlink](https://junglewise.ai/threats/cve-2026-111802-a-flaw-was-found-in-nautilus-when-a-removable-drive-or-disk) (medium, CVSS 6.6, published 16 Oct 2026) - [CVE-2026-62438: GIMP integer overflow in PAA texture file handling](https://junglewise.ai/threats/cve-2026-62438-a-flaw-was-found-in-gimp-an-attacker-can-cause-a-denial-of) (medium, CVSS 6.1, published 16 Oct 2026) - [CVE-2026-111132: GNOME libgxps heap out-of-bounds read in path geometry parsing](https://junglewise.ai/threats/cve-2026-111132-gnome-libgxps-through-0-3-2-contains-a-heap-out-of-bounds-read) (medium, CVSS 6.1, published 15 Oct 2026) - [CVE-2026-110777: GNOME evolution-data-server file read via CalDAV ATTACH property](https://junglewise.ai/threats/cve-2026-110777-a-flaw-was-found-in-evolution-data-server-calendar-events) (medium, CVSS 5.7, published 14 Oct 2026) - [CVE-2026-108094: Mutter use-after-free in Wayland color-management ICC image-description](https://junglewise.ai/threats/cve-2026-108094-a-use-after-free-flaw-was-found-in-mutter-in-the-wayland-color) (high, CVSS 7.8, published 12 Oct 2026) - [CVE-2026-107651: Eye of GNOME heap-based buffer overflow in PNG metadata reader](https://junglewise.ai/threats/cve-2026-107651-a-flaw-was-found-in-eye-of-gnome-eog-a-heap-based-buffer) (medium, CVSS 5.5, published 8 Oct 2026) - [sharp memory corruption in librsvg dependency](https://junglewise.ai/threats/sharp-vulnerability-in-librsvg-dependency-b5d03f31) (high, published 6 Oct 2026) - [CVE-2026-103399: libsoup HTTP request smuggling via undrained Expect: 100-continue body](https://junglewise.ai/threats/cve-2026-103399-a-flaw-was-found-in-soupserver-libsoup-when-an-http-1-x-client) (medium, CVSS 5.3, published 30 Sep 2026) - [CVE-2026-102560: libsoup heap buffer overflow in permessage-deflate WebSocket extension](https://junglewise.ai/threats/cve-2026-102560-a-flaw-was-found-in-libsoup-when-the-permessage-deflate) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102558: libsoup heap buffer overflow in WebSocket handling](https://junglewise.ai/threats/cve-2026-102558-a-flaw-was-found-in-libsoup-when-max-incoming-payload-size-is) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102555: libsoup out-of-bounds read in data-URI base64 decoding](https://junglewise.ai/threats/cve-2026-102555-a-flaw-was-found-in-libsoup-the-soup-uri-decode-data-uri) (high, CVSS 8.2, published 29 Sep 2026) - [CVE-2026-102557: libsoup heap corruption in WebSocket message reassembly](https://junglewise.ai/threats/cve-2026-102557-a-flaw-was-found-in-libsoup-when-reassembling-fragmented) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102556: libsoup type confusion in WebSocket Pong signal](https://junglewise.ai/threats/cve-2026-102556-a-flaw-was-found-in-libsoup-when-handling-an-incoming-websocket) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-91841: NetworkManager-vpnc CA-File path newline injection privilege escalation](https://junglewise.ai/threats/cve-2026-91841-a-flaw-was-found-in-networkmanager-vpnc-a-vpn-plugin-for) (high, CVSS 7.8, published 25 Sep 2026) - [CVE-2026-91840: NetworkManager-vpnc privilege escalation via newline injection in VPN username](https://junglewise.ai/threats/cve-2026-91840-a-flaw-was-found-in-networkmanager-vpnc-this-vulnerability-allows) (high, CVSS 7.8, published 25 Sep 2026) - [CVE-2026-91838: NetworkManager-sstp shell injection in VPN profile fields](https://junglewise.ai/threats/cve-2026-91838-a-flaw-was-found-in-networkmanager-sstp-the-sstp-vpn-plugin-for) (high, CVSS 7.8, published 25 Sep 2026) - [CVE-2026-91837: NetworkManager-iodine command injection in nameserver option](https://junglewise.ai/threats/cve-2026-91837-a-flaw-was-found-in-networkmanager-iodine-the-iodine-vpn-plugin) (high, CVSS 7.8, published 25 Sep 2026) ## Most severe Gnome vulnerabilities - [CVE-2019-11068: Nokogiri libxslt protection mechanism bypass via crafted URL](https://junglewise.ai/threats/cve-2019-11068-nokogiri-libxslt-protection-mechanism-bypass-via-crafted-url) (critical, CVSS 9.8, published 13 May 2022) - [CVE-2026-84268: GNOME gvfs SFTP backend heap overflow](https://junglewise.ai/threats/cve-2026-84268-gnome-gvfs-sftp-backend-heap-overflow) (high, CVSS 8.8, published 1 Sep 2026) - [CVE-2026-1761: GNOME libsoup stack-based buffer overflow in multipart response parsing](https://junglewise.ai/threats/cve-2026-1761-gnome-libsoup-stack-based-buffer-overflow-in-multipart-response) (high, CVSS 8.6, published 2 Feb 2026) - [CVE-2026-0719: GNOME libsoup stack buffer overflow in NTLM authentication](https://junglewise.ai/threats/cve-2026-0719-gnome-libsoup-stack-buffer-overflow-in-ntlm-authentication) (high, CVSS 8.6, published 8 Jan 2026) - [CVE-2026-102560: libsoup heap buffer overflow in permessage-deflate WebSocket extension](https://junglewise.ai/threats/cve-2026-102560-a-flaw-was-found-in-libsoup-when-the-permessage-deflate) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102558: libsoup heap buffer overflow in WebSocket handling](https://junglewise.ai/threats/cve-2026-102558-a-flaw-was-found-in-libsoup-when-max-incoming-payload-size-is) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102557: libsoup heap corruption in WebSocket message reassembly](https://junglewise.ai/threats/cve-2026-102557-a-flaw-was-found-in-libsoup-when-reassembling-fragmented) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2026-102556: libsoup type confusion in WebSocket Pong signal](https://junglewise.ai/threats/cve-2026-102556-a-flaw-was-found-in-libsoup-when-handling-an-incoming-websocket) (high, CVSS 8.6, published 29 Sep 2026) - [CVE-2025-14523: GNOME libsoup HTTP request smuggling via duplicate Host headers](https://junglewise.ai/threats/cve-2025-14523-gnome-libsoup-http-request-smuggling-via-duplicate-host-headers) (high, CVSS 8.2, published 11 Dec 2025) - [CVE-2026-102555: libsoup out-of-bounds read in data-URI base64 decoding](https://junglewise.ai/threats/cve-2026-102555-a-flaw-was-found-in-libsoup-the-soup-uri-decode-data-uri) (high, CVSS 8.2, published 29 Sep 2026) ## Vulnerabilities per week 13 vulnerabilities in the last four weeks, down 28% on the four before (18). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 5 | 0 | 0 | | 31 Aug 2026 | 6 | 0 | 0 | | 7 Sep 2026 | 4 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 9 | 0 | 0 | | 28 Sep 2026 | 6 | 0 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 5 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 7 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Gnome technologies - [Gnome Libsoup](https://junglewise.ai/threats/technologies/libsoup): 43 vulnerabilities - [Gnome GLib](https://junglewise.ai/threats/technologies/glib): 18 vulnerabilities - [Gnome Libxslt](https://junglewise.ai/threats/technologies/libxslt): 7 vulnerabilities - [Gnome Gdk-Pixbuf](https://junglewise.ai/threats/technologies/gdk-pixbuf): 5 vulnerabilities - [Gnome GIMP](https://junglewise.ai/threats/technologies/gnome-gimp): 5 vulnerabilities - [Gnome Gvfs](https://junglewise.ai/threats/technologies/gvfs): 5 vulnerabilities - [Gnome Glib-Networking](https://junglewise.ai/threats/technologies/glib-networking): 4 vulnerabilities - [Gnome Localsearch](https://junglewise.ai/threats/technologies/localsearch): 4 vulnerabilities - [Gnome Epiphany](https://junglewise.ai/threats/technologies/epiphany): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Gnome vulnerabilities", https://junglewise.ai/threats/vendors/gnome, 12 November 2026.