Gnome
Gnome Epiphany: vulnerabilidades y CVE
Gnome Epiphany tiene 15 vulnerabilidades publicadas, 2 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE15
Últimos 12 meses2
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-18487 | Media (5.4) | 0.34% | — | 6 ago 2026 | A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example,… |
| CVE-2025-3839 | Alta (8) | 0.40% | — | 23 ene 2026 | A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them… |
| CVE-2023-26081 | Alta (7.5) | 1.2% | — | 20 feb 2023 | In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts. |
| CVE-2022-29536 | Alta (7.5) | 2.0% | — | 20 abr 2022 | In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes… |
| CVE-2021-45088 | Media (6.1) | 1.4% | — | 16 dic 2021 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page. |
| CVE-2021-45087 | Media (6.1) | 1.5% | — | 16 dic 2021 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title. |
| CVE-2021-45086 | Media (6.1) | 1.3% | — | 16 dic 2021 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js. |
| CVE-2021-45085 | Media (6.1) | 1.5% | — | 16 dic 2021 | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most… |
| CVE-2019-6251 | Alta (8.1) | 4.1% | — | 14 ene 2019 | WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This… |
| CVE-2018-12016 | Alta (7.5) | 1.9% | — | 7 jun 2018 | libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write calls. |
| CVE-2018-11396 | Alta (7.5) | 1.5% | — | 23 may 2018 | ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as… |
| CVE-2017-1000025 | Alta (7.5) | 1.4% | — | 17 jul 2017 | GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager sweep attack resulting in the remote exfiltration of stored… |
| CVE-2010-3312 | Media (5.8) | 1.0% | — | 14 oct 2010 | Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the user, which allows man-in-the-middle… |
| CVE-2008-5985 | Media (6.9) | 0.37% | — | 28 ene 2009 | Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory,… |
| CVE-2005-0238 | Media (5) | 1.6% | — | 2 may 2005 | The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph… |