{"meta":{"title":"KEV entries: GNU","description":"All KEV entries for vendor GNU.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":5,"vendor":"GNU","entries":5,"shareOfCatalogPercent":0.3,"ransomwareKnown":0,"firstDateAdded":"2022-01-28","latestDateAdded":"2026-01-26","rank":46},"data":[{"cveID":"CVE-2026-24061","vendorProject":"GNU","product":"InetUtils","vulnerabilityName":"GNU InetUtils Argument Injection Vulnerability","dateAdded":"2026-01-26","dueDate":"2026-02-16","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-88"],"shortDescription":"GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a \"-f root\" value for the USER environment variable.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cgit.git.savannah.gnu.org/cgit/inetutils.git ; https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc; https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b ; https://nvd.nist.gov/vuln/detail/CVE-2026-24061","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-24061"},{"cveID":"CVE-2014-6278","vendorProject":"GNU","product":"GNU Bash","vulnerabilityName":"GNU Bash OS Command Injection Vulnerability","dateAdded":"2025-10-02","dueDate":"2025-10-23","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. ","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 ; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23467 ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash ; https://www.ibm.com/support/pages/security-bulletin-update-vulnerabilities-bash-affect-aix-toolbox-linux-applications-cve-2014-6271-cve-2014-6277-cve-2014-6278-cve-2014-7169-cve-2014-7186-and-cve-2014-7187 ; https://nvd.nist.gov/vuln/detail/CVE-2014-6278","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2014-6278"},{"cveID":"CVE-2023-4911","vendorProject":"GNU","product":"GNU C Library","vulnerabilityName":"GNU C Library Buffer Overflow Vulnerability","dateAdded":"2023-11-21","dueDate":"2023-12-12","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-122"],"shortDescription":"GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa, https://access.redhat.com/security/cve/cve-2023-4911, https://www.debian.org/security/2023/dsa-5514 ; https://nvd.nist.gov/vuln/detail/CVE-2023-4911  ","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-4911"},{"cveID":"CVE-2014-7169","vendorProject":"GNU","product":"Bourne-Again Shell (Bash)","vulnerabilityName":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","dateAdded":"2022-01-28","dueDate":"2022-07-28","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-7169","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-7169"},{"cveID":"CVE-2014-6271","vendorProject":"GNU","product":"Bourne-Again Shell (Bash)","vulnerabilityName":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","dateAdded":"2022-01-28","dueDate":"2022-07-28","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-6271","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2014-6271"}]}