{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: GNU vulnerabilities","home_page_url":"https://patchfirst.co/vendor/gnu/","feed_url":"https://patchfirst.co/feed/vendor/gnu.json","description":"New and newly exploited GNU CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-24061#kev","url":"https://patchfirst.co/cve/CVE-2026-24061/","title":"[KEV] CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability","content_text":"GNU · InetUtils. In CISA KEV since 2026-01-26. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 84.8 of 100.","summary":"GNU InetUtils Argument Injection Vulnerability","date_published":"2026-01-26T00:00:00.000Z","date_modified":"2026-09-30T11:47:02.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":84.8,"kev":{"dateAdded":"2026-01-26","ransomware":false},"epss":{"score":0.98984,"percentile":0.9993},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GNU","product":"InetUtils","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-6278#kev","url":"https://patchfirst.co/cve/CVE-2014-6278/","title":"[KEV] CVE-2014-6278: GNU Bash OS Command Injection Vulnerability","content_text":"GNU · GNU Bash. In CISA KEV since 2025-10-02. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1059.004 Unix Shell. Named in 1 threat report. Priority 73.0 of 100.","summary":"GNU Bash OS Command Injection Vulnerability","date_published":"2025-10-02T00:00:00.000Z","date_modified":"2026-06-17T00:12:50.000Z","tags":["kev","public-exploit","T1059.004"],"_patchfirst":{"reason":"kev","priority":73,"kev":{"dateAdded":"2025-10-02","ransomware":false},"epss":{"score":0.99669,"percentile":0.9995},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"GNU","product":"GNU Bash","techniqueIds":["T1059.004"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-4911#kev","url":"https://patchfirst.co/cve/CVE-2023-4911/","title":"[KEV] CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability","content_text":"GNU · GNU C Library. In CISA KEV since 2023-11-21. ENISA EUVD lists it as exploited. EPSS 63.8% (higher than 99.22% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 78.3 of 100.","summary":"GNU C Library Buffer Overflow Vulnerability","date_published":"2023-11-21T00:00:00.000Z","date_modified":"2026-10-14T22:17:18.000Z","tags":["kev","public-exploit","T1068"],"_patchfirst":{"reason":"kev","priority":78.3,"kev":{"dateAdded":"2023-11-21","ransomware":false},"epss":{"score":0.63769,"percentile":0.99219},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"GNU","product":"GNU C Library","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-6271#kev","url":"https://patchfirst.co/cve/CVE-2014-6271/","title":"[KEV] CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","content_text":"GNU · Bourne-Again Shell (Bash). In CISA KEV since 2022-01-28. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Named in 2 threat reports. Priority 76.0 of 100.","summary":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","date_published":"2022-01-28T00:00:00.000Z","date_modified":"2026-06-17T00:12:48.000Z","tags":["kev","public-exploit","T1133","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":76,"kev":{"dateAdded":"2022-01-28","ransomware":false},"epss":{"score":0.99999,"percentile":0.99993},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GNU","product":"Bourne-Again Shell (Bash)","techniqueIds":["T1133","T1190","T1059.004"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2014-7169#kev","url":"https://patchfirst.co/cve/CVE-2014-7169/","title":"[KEV] CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","content_text":"GNU · Bourne-Again Shell (Bash). In CISA KEV since 2022-01-28. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 69.9 of 100.","summary":"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","date_published":"2022-01-28T00:00:00.000Z","date_modified":"2026-06-17T00:14:28.000Z","tags":["kev","public-exploit","T1133","T1190","T1059.004"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2022-01-28","ransomware":false},"epss":{"score":0.9994,"percentile":0.99972},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"GNU","product":"Bourne-Again Shell (Bash)","techniqueIds":["T1133","T1190","T1059.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}