CVE-2023-26081

< 43.1

In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occu

7.5HIGH

CVE-2022-29536

< 41.4

In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten

7.5HIGH

CVE-2021-45088

< 40.4

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.

6.1MEDIUM

CVE-2021-45087

< 40.4

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demons

6.1MEDIUM

CVE-2021-45086

< 40.4

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pd

6.1MEDIUM

CVE-2021-45085

< 40.4

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overv

6.1MEDIUM

CVE-2019-6251

<= 3.31.4

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An a

8.1HIGH

CVE-2018-12016

<= 3.28.2.1

libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application cras

7.5HIGH

CVE-2018-11396

<= 3.28.2.1

ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service

7.5HIGH

CVE-2017-1000025

all versions

GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulne

7.5HIGH

CVE-2010-3312

all versions

Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with t

CVE-2008-5985

all versions

Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to

CVE-2005-0238

all versions

The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domai