GNU Project

Products

Exploited and recent CVEs

• CVE-2026-109831 Medium 5.4 UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition. 0.2%
• CVE-2025-62689 High 7.5 NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the 0.5%
• CVE-2025-59777 High 7.5 NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the 0.5%
• CVE-2022-28736 Medium 6.4 There's a use-after-free vulnerability in grub_cmd_chainloader() function 0.3%
• CVE-2022-28735 Medium 6.7 The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 0.3%
• CVE-2022-28734 High 8.1 Out-of-bounds write when handling split HTTP headers 1.1%
• CVE-2022-28733 High 8.1 Integer underflow in grub_net_recv_ip4_packets 1.3%