Lynx
24 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Lynx, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Lynx CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 24 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High7
- Medium13
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Lynx.
- CVE-2023-40143Westermo Lynx 5.4
- CVE-2023-45735Westermo Lynx Code Injection8.0
- CVE-2023-45222Westermo Lynx Cross-site Scripting5.4
- CVE-2023-45213 Westermo Lynx Permissive Cross-domain Policy with Untrusted Domains6.6
- CVE-2023-42765Westermo Lynx Cross-site Scripting5.4
- CVE-2023-40544Westermo Lynx Cleartext Transmission of Sensitive Information5.7
- CVE-2023-45227Westermo Lynx Cross-site Scripting5.4
- CVE-2023-38579Westermo Lynx 206-F2G Cross-Site Request Forgery8.0
- CVE-2021-38165Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data.5.3
- CVE-2014-5002The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.7.8
- CVE-2017-1000211Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTML_put_string() can append a chunk onto itself.5.3
- CVE-2016-9179lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.7.5
- CVE-2012-5821Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related t...5.9
- CVE-2010-2810Heap-based buffer overflow in the convert_to_idna function in WWW/Library/Implementation/HTParse.c in Lynx 2.8.8dev.1 through 2.8.8dev.4 allows remote attackers to cause a denial of service (applic...6.8
- CVE-2006-7234Untrusted search path vulnerability in Lynx before 2.8.6rel.4 allows local users to execute arbitrary code via malicious (1) .mailcap and (2) mime.types files in the current working directory.4.6
Product grouping is registry-driven, with AI assist and human review. How it works