Known vulnerabilities in GNOME Web (Epiphany)

Software CPE: cpe:2.3:a:gnome:epiphany:*:*:*:*:*:*:*:*
Total vulnerabilities: 10
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting GNOME Web (Epiphany) GNOME Web (Epiphany) is affected by 10 known vulnerabilities: 3 high, 5 medium, 2 low Critical High Medium Low

Vulnerabilities (10)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU107894 - Insufficient UI Warning of Dangerous Operations
CVE-2025-3839
CWE-357 High
No
No
47.5, 48.1 23.04.2025 SB2025042359
SB2025042421
SB2025042422
#VU79636 - Exposure of resource to wrong sphere
CVE-2023-26081
CWE-668 Medium
No
No
43.1 16.08.2023 SB20230816236
SB20230816238
SB20230816239
and 2 more
#VU66422 - Out-of-bounds write
CVE-2022-29536
CWE-787 High
No
No
41.4, 42.2 12.08.2022 SB2022081208
SB2022081209
SB2022081717
and 5 more
#VU59665 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-45088
CWE-79 Medium
No
No
40.4, 41.1 17.01.2022 SB2022011722
SB2022011725
SB2022051178
#VU59664 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-45087
CWE-79 Medium
No
No
40.4, 41.1 17.01.2022 SB2022011722
SB2022011725
SB2022081209
and 1 more
#VU59663 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-45086
CWE-79 Medium
No
No
40.4, 41.1 17.01.2022 SB2022011722
SB2022011725
SB2022081209
and 1 more
#VU59662 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-45085
CWE-79 High
No
No
40.4, 41.1 17.01.2022 SB2022011722
SB2022011725
SB2022081209
and 1 more
#VU13558 - Improper input validation
CVE-2018-12016
CWE-20 Low
No
No
- 04.07.2018 SB2018070405
SB2018060824
SB2018060825
and 1 more
#VU13557 - Improper input validation
CVE-2018-11396
CWE-20 Low
Available
No
- 03.07.2018 SB2018070405
SB2018103030
SB2019101606
and 4 more
#VU38709 - Exposure of sensitive information to an unauthorized actor
CVE-2017-1000025
CWE-200 Medium
No
No
- 17.07.2017 SB2017071724