Inkscape
by Inkscape
CVEs (10)
| CVE | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2012-5656 | Med | 0.36 | 5.5 | 0.00 | Jan 18, 2013 | The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack. | |
| CVE-2005-3737 | 0.05 | — | 0.28 | Nov 22, 2005 | Buffer overflow in the SVG importer (style.cpp) of inkscape 0.41 through 0.42.2 might allow remote attackers to execute arbitrary code via a SVG file with long CSS style property values. | ||
| CVE-2007-1464 | 0.01 | — | 0.07 | Mar 21, 2007 | Format string vulnerability in the whiteboard Jabber protocol in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. | ||
| CVE-2007-1463 | 0.01 | — | 0.17 | Mar 21, 2007 | Format string vulnerability in Inkscape before 0.45.1 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs. | ||
| CVE-2026-4980 | 0.00 | — | 0.00 | Mar 27, 2026 | A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags. | ||
| CVE-2021-42704 | 0.00 | — | 0.01 | May 18, 2022 | Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code. | ||
| CVE-2021-42702 | 0.00 | — | 0.00 | May 18, 2022 | Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information. | ||
| CVE-2021-42700 | 0.00 | — | 0.00 | May 18, 2022 | Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized information. | ||
| CVE-2012-6076 | 0.00 | — | 0.00 | Mar 12, 2013 | Inkscape before 0.48.4 reads .eps files from /tmp instead of the current directory, which might cause Inkspace to process unintended files, allow local users to obtain sensitive information, and possibly have other unspecified impacts. | ||
| CVE-2005-3885 | 0.00 | — | 0.00 | Nov 29, 2005 | The ps2epsi extension shell script (ps2epsi.sh) in Inkscape before 0.41 allows local users to overwrite arbitrary files via a symlink attack on the tmpepsifile.epsi temporary file. |