--- title: "WebKitGTK vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/webkitgtk type: vendor description: "WebKitGTK has 135 published CVEs, 16 in CISA KEV and 53 with public exploits." updated: 2026-08-31 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # WebKitGTK vulnerabilities - **Published CVEs:** 135 - **In CISA KEV:** 16 - **With a public exploit:** 53 - **With a patch:** 134 - **Average CVSS:** 8.0 - **CVEs in the last two years:** 6 - **First CVE:** 2010-08-24 - **Latest CVE:** 2026-08-31 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 22 | | High | 75 | | Medium | 36 | | Low | 2 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [WebKitGTK](https://radicalnotion.ai/vendor/webkitgtk/webkitgtk) | 71 | | [WebKitGTK+](https://radicalnotion.ai/vendor/webkitgtk/webkitgtk-0kdy) | 64 | | [webkit2gtk3](https://radicalnotion.ai/vendor/webkitgtk/webkit2gtk3) | 1 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-119](https://radicalnotion.ai/cwe/cwe-119) | Improper Restriction of Operations within the Bounds of a Memory Buffer | 34 | | [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 28 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 11 | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 7 | | [CWE-787](https://radicalnotion.ai/cwe/cwe-787) | Out-of-bounds Write | 7 | | [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 6 | | [CWE-190](https://radicalnotion.ai/cwe/cwe-190) | Integer Overflow or Wraparound | 3 | | [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 3 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [apple](https://radicalnotion.ai/cna/apple) | 84 | | [mitre](https://radicalnotion.ai/cna/mitre) | 38 | | [talos](https://radicalnotion.ai/cna/talos) | 7 | | [redhat](https://radicalnotion.ai/cna/redhat) | 4 | | [Chrome](https://radicalnotion.ai/cna/chrome) | 2 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2019 | 14 | | 2020 | 9 | | 2021 | 15 | | 2022 | 4 | | 2023 | 19 | | 2024 | 7 | | 2025 | 4 | | 2026 | 2 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-83596 | Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature | high | 8.8 | 0.5% | No | 2026-08-31 | | CVE-2026-78376 | Webkitgtk: use-after-free of jscvalue function parameters | high | 8.8 | 0.5% | No | 2026-08-24 | | CVE-2025-43343 | - | critical | 9.8 | 0.8% | No | 2025-09-15 | | CVE-2025-43342 | - | critical | 9.8 | 0.8% | No | 2025-09-15 | | CVE-2025-31277 | - | critical | 9.4 | 1.7% | Yes | 2025-07-29 | | CVE-2025-6558 | - | critical | 9.4 | 10.9% | Yes | 2025-07-15 | | CVE-2024-27834 | - | medium | 5.5 | 1.5% | Yes | 2024-05-13 | | CVE-2024-23263 | - | high | 8.1 | 1.5% | No | 2024-03-08 | | CVE-2024-23280 | - | high | 7.5 | 1.3% | No | 2024-03-08 | | CVE-2024-23254 | - | medium | 6.5 | 1.3% | No | 2024-03-08 | | CVE-2024-23284 | - | medium | 6.5 | 1.5% | No | 2024-03-08 | | CVE-2024-23246 | - | high | 8.6 | 0.7% | No | 2024-03-08 | ## Frequently asked questions ### How many CVEs does WebKitGTK have? WebKitGTK has 135 published CVE records since 2010, including 6 in the last two years. ### How many WebKitGTK CVEs are in CISA KEV? 16 of WebKitGTK's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline. ### Which WebKitGTK products have the most CVEs? The WebKitGTK products with the most published CVEs are WebKitGTK, WebKitGTK+, webkit2gtk3. ### What are the most common weakness types in WebKitGTK CVEs? WebKitGTK's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-416 (Use After Free), CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')). ### Are there public exploits for WebKitGTK vulnerabilities? Yes — 53 of WebKitGTK's CVEs have a known public exploit. ### How many critical WebKitGTK vulnerabilities are there? WebKitGTK has 22 critical and 75 high-severity CVEs. ### What is the average severity of WebKitGTK CVEs? The average CVSS base score across WebKitGTK's scored CVEs is 8.0. ## Related vendors - [Crocoblock](https://radicalnotion.ai/vendor/crocoblock) (136 CVEs) - [Ruijie](https://radicalnotion.ai/vendor/ruijie) (136 CVEs) - [Tanium](https://radicalnotion.ai/vendor/tanium) (136 CVEs) - [Themeisle](https://radicalnotion.ai/vendor/themeisle) (136 CVEs) - [Go standard library](https://radicalnotion.ai/vendor/gostandardlibrary) (135 CVEs) - [vLLM](https://radicalnotion.ai/vendor/vllm) (135 CVEs) - [Motorola](https://radicalnotion.ai/vendor/motorola) (134 CVEs) - [Checkmk](https://radicalnotion.ai/vendor/checkmk) (134 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/webkitgtk). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.