Lookup for vulnerable packages by Package URL.
| Purl | pkg:deb/debian/epiphany-browser@3.22.7-1 |
| Type | deb |
| Namespace | debian |
| Name | epiphany-browser |
| Version | 3.22.7-1 |
| Qualifiers |
|
| Subpath | |
| Is_vulnerable | true |
| Next_non_vulnerable_version | 48.5-0+deb13u1 |
| Latest_non_vulnerable_version | 48.5-0+deb13u1 |
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-113w-tac1-63hu |
| vulnerability_id |
VCID-113w-tac1-63hu |
| summary |
ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as demonstrated by a crafted window.open call. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-11396 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00685 |
| scoring_system |
epss |
| scoring_elements |
0.72074 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00685 |
| scoring_system |
epss |
| scoring_elements |
0.72115 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00685 |
| scoring_system |
epss |
| scoring_elements |
0.72122 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00685 |
| scoring_system |
epss |
| scoring_elements |
0.721 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00685 |
| scoring_system |
epss |
| scoring_elements |
0.72086 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00685 |
| scoring_system |
epss |
| scoring_elements |
0.72111 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-11396 |
|
| 1 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-11396
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-113w-tac1-63hu |
|
| 1 |
| url |
VCID-68bf-4ptn-qbhe |
| vulnerability_id |
VCID-68bf-4ptn-qbhe |
| summary |
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45088 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52511 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52571 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.5258 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.5256 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52533 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52555 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45088 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-45088
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-68bf-4ptn-qbhe |
|
| 2 |
| url |
VCID-6g3a-39k8-r7fn |
| vulnerability_id |
VCID-6g3a-39k8-r7fn |
| summary |
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most Visited list. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45085 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52511 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52571 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.5258 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.5256 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52533 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52555 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45085 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-45085
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6g3a-39k8-r7fn |
|
| 3 |
| url |
VCID-atbz-s192-gfgn |
| vulnerability_id |
VCID-atbz-s192-gfgn |
| summary |
libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write calls. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-12016 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00894 |
| scoring_system |
epss |
| scoring_elements |
0.75961 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00894 |
| scoring_system |
epss |
| scoring_elements |
0.75987 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00894 |
| scoring_system |
epss |
| scoring_elements |
0.75986 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00894 |
| scoring_system |
epss |
| scoring_elements |
0.75978 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00894 |
| scoring_system |
epss |
| scoring_elements |
0.75964 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00894 |
| scoring_system |
epss |
| scoring_elements |
0.75989 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-12016 |
|
| 1 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-12016
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-atbz-s192-gfgn |
|
| 4 |
| url |
VCID-h22c-45hd-bkg9 |
| vulnerability_id |
VCID-h22c-45hd-bkg9 |
| summary |
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45086 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00212 |
| scoring_system |
epss |
| scoring_elements |
0.43728 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00212 |
| scoring_system |
epss |
| scoring_elements |
0.43798 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00212 |
| scoring_system |
epss |
| scoring_elements |
0.43808 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00212 |
| scoring_system |
epss |
| scoring_elements |
0.43783 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00212 |
| scoring_system |
epss |
| scoring_elements |
0.43749 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00212 |
| scoring_system |
epss |
| scoring_elements |
0.43759 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45086 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-45086
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-h22c-45hd-bkg9 |
|
| 5 |
| url |
VCID-hw9a-62ta-ubam |
| vulnerability_id |
VCID-hw9a-62ta-ubam |
| summary |
A vulnerability was found in GNOME gvdb. It has been classified as critical. This affects the function gvdb_table_write_contents_async of the file gvdb-builder.c. The manipulation leads to use after free. It is possible to initiate the attack remotely. The name of the patch is d83587b2a364eb9a9a53be7e6a708074e252de14. It is recommended to apply a patch to fix this issue. The identifier VDB-216789 was assigned to this vulnerability. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-25085 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00538 |
| scoring_system |
epss |
| scoring_elements |
0.67898 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00538 |
| scoring_system |
epss |
| scoring_elements |
0.67937 |
| published_at |
2026-06-09T12:55:00Z |
|
| 2 |
| value |
0.00538 |
| scoring_system |
epss |
| scoring_elements |
0.67922 |
| published_at |
2026-06-08T12:55:00Z |
|
| 3 |
| value |
0.00538 |
| scoring_system |
epss |
| scoring_elements |
0.67944 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00538 |
| scoring_system |
epss |
| scoring_elements |
0.67934 |
| published_at |
2026-06-07T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-25085 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-25085
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hw9a-62ta-ubam |
|
| 6 |
| url |
VCID-npfg-tmhk-vfb1 |
| vulnerability_id |
VCID-npfg-tmhk-vfb1 |
| summary |
arbitrary code execution |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-29536 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00151 |
| scoring_system |
epss |
| scoring_elements |
0.35463 |
| published_at |
2026-06-06T12:55:00Z |
|
| 1 |
| value |
0.00151 |
| scoring_system |
epss |
| scoring_elements |
0.35409 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00151 |
| scoring_system |
epss |
| scoring_elements |
0.35505 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.00151 |
| scoring_system |
epss |
| scoring_elements |
0.35404 |
| published_at |
2026-06-09T12:55:00Z |
|
| 4 |
| value |
0.00151 |
| scoring_system |
epss |
| scoring_elements |
0.35428 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00151 |
| scoring_system |
epss |
| scoring_elements |
0.35387 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-29536 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2022-29536
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-npfg-tmhk-vfb1 |
|
| 7 |
| url |
VCID-xfvn-bv4e-rfhq |
| vulnerability_id |
VCID-xfvn-bv4e-rfhq |
| summary |
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45087 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52511 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52571 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.5258 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.5256 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52533 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00288 |
| scoring_system |
epss |
| scoring_elements |
0.52555 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45087 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-45087
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xfvn-bv4e-rfhq |
|
|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-qt2c-1r4u-y3be |
| vulnerability_id |
VCID-qt2c-1r4u-y3be |
| summary |
GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager sweep attack resulting in the remote exfiltration of stored passwords for a selected set of websites. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2017-1000025 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00498 |
| scoring_system |
epss |
| scoring_elements |
0.66229 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00498 |
| scoring_system |
epss |
| scoring_elements |
0.6628 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00498 |
| scoring_system |
epss |
| scoring_elements |
0.66289 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00498 |
| scoring_system |
epss |
| scoring_elements |
0.66273 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00498 |
| scoring_system |
epss |
| scoring_elements |
0.66259 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00498 |
| scoring_system |
epss |
| scoring_elements |
0.66277 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2017-1000025 |
|
| 1 |
|
|
| fixed_packages |
|
| aliases |
CVE-2017-1000025
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qt2c-1r4u-y3be |
|
|
| Risk_score | 4.0 |
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:deb/debian/epiphany-browser@3.22.7-1 |