CVE-2026-15037 | | | 2026-07-23 | Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrus… |
CVE-2026-9499 | | | 2026-07-21 | An out-of-bounds read (buffer over-read) vulnerability exists in QTextCodec::codecForName() in Qt. When the function is called with a QByteArray that is not NU… |
CVE-2026-12379 | | | 2026-07-16 | An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restr… |
CVE-2026-12593 | | | 2026-07-09 | The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an AP… |
CVE-2025-14575 | | | 2026-05-19 | An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a… |
CVE-2026-6210 | | | 2026-05-06 | A type confusion vulnerability in Qt SVG allows an attacker to cause an application crash via a crafted SVG image.
When processing SVG marker references, th… |
CVE-2025-14576 | High | 7.8 | 2026-04-30 | Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage co… |
CVE-2025-12385 | | | 2025-12-03 | Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS… |
CVE-2025-23050 | Low | 3.1 | 2025-10-31 | QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). This is fixed in 5… |
CVE-2025-6338 | | | 2025-10-16 | There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period.
This issue… |
CVE-2025-10729 | | | 2025-10-03 | The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading t… |
CVE-2025-10728 | | | 2025-10-03 | When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading to stack overflow DoS |
CVE-2025-5992 | | | 2025-07-11 | When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing… |
CVE-2025-5991 | | | 2025-06-11 | There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module. This only affects HTTP/2 handling, HTTP handling is not affect… |
CVE-2025-5683 | Medium | 5.5 | 2025-06-05 | When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash.
This issue affects Qt from versions 6.3.0 through 6.5.9, f… |
CVE-2025-5455 | | | 2025-06-02 | An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.
… |
CVE-2025-4211 | | | 2025-05-16 | Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows… |
CVE-2025-3512 | | | 2025-04-11 | There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdow… |
CVE-2025-30348 | Medium | 5.8 | 2025-03-21 | encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later d… |
CVE-2024-39936 | High | 8.6 | 2024-07-04 | An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make… |
CVE-2024-36048 | Critical | 9.8 | 2024-05-18 | QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses… |
CVE-2024-25580 | Medium | 6.2 | 2024-03-27 | An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer… |
CVE-2024-30161 | Medium | 6.5 | 2024-03-24 | In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are… |
CVE-2023-51714 | Critical | 9.8 | 2023-12-24 | An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/… |
CVE-2023-43114 | Medium | 5.5 | 2023-09-18 | An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupte… |
CVE-2023-37369 | High | 7.5 | 2023-08-20 | In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string th… |
CVE-2021-28025 | Medium | 5.5 | 2023-08-11 | Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS). |
CVE-2023-38197 | High | 7.5 | 2023-07-13 | An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion. |
CVE-2023-34410 | Medium | 5.3 | 2023-06-05 | An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider w… |
CVE-2023-32763 | High | 7.5 | 2023-05-28 | An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QT… |
CVE-2023-32762 | Medium | 5.3 | 2023-05-28 | An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-securi… |
CVE-2023-33285 | Medium | 5.3 | 2023-05-22 | An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply… |
CVE-2023-32573 | Medium | 6.5 | 2023-05-10 | In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled. |
CVE-2023-24607 | High | 7.5 | 2023-04-15 | Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions ar… |
CVE-2022-43591 | High | 8.8 | 2023-01-12 | A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an out-of-bounds… |
CVE-2022-40983 | High | 8.8 | 2023-01-12 | An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer ove… |
CVE-2021-3481 | High | 7.1 | 2022-08-22 | A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelper_p.h in Qt/Qtbase. While ren… |
CVE-2022-25634 | High | 7.5 | 2022-03-02 | Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. |
CVE-2022-25255 | High | 7.8 | 2022-02-16 | In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not fo… |
CVE-2021-45930 | Medium | 5.5 | 2022-01-01 | Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend (called f… |
CVE-2021-38593 | High | 7.5 | 2021-08-12 | Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx… |
CVE-2020-24742 | High | 7.8 | 2021-08-09 | An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arb… |
CVE-2020-0569 | Medium | 5.7 | 2020-11-23 | Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of service via local a… |
CVE-2020-0570 | High | 7.3 | 2020-09-14 | Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via lo… |
CVE-2020-17507 | Medium | 5.3 | 2020-08-12 | An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read. |
CVE-2020-13962 | High | 7.5 | 2020-06-09 | Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of servic… |
CVE-2020-12267 | Critical | 9.8 | 2020-04-27 | setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock. |
CVE-2018-21035 | High | 7.5 | 2020-02-28 | In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier… |
CVE-2015-9541 | High | 7.5 | 2020-01-24 | Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-200… |
CVE-2019-18281 | Medium | 4.3 | 2019-10-23 | An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to ca… |
CVE-2018-19872 | Medium | 5.5 | 2019-03-21 | An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp. |
CVE-2018-19873 | Critical | 9.8 | 2018-12-26 | An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data. |
CVE-2018-19871 | Medium | 6.5 | 2018-12-26 | An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption. |
CVE-2018-19870 | High | 8.8 | 2018-12-26 | An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault. |
CVE-2018-19869 | Medium | 6.5 | 2018-12-26 | An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp. |
CVE-2018-15518 | High | 8.8 | 2018-12-26 | QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document. |
CVE-2018-19865 | High | 7.5 | 2018-12-05 | A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3. |
CVE-2015-1290 | High | 8.8 | 2018-01-09 | The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause a denial of service… |
CVE-2017-10905 | Medium | 5.3 | 2017-12-16 | A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors. |
CVE-2017-10904 | Critical | 9.8 | 2017-12-16 | Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2017-15011 | High | 7.5 | 2017-10-04 | The named pipes in qtsingleapp in Qt 5.x, as used in qBittorrent and SugarSync, are configured for remote access and allow remote attackers to cause a denial o… |
CVE-2015-8079 | Medium | 5.3 | 2017-09-07 | qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db. |
CVE-2016-10040 | Medium | 5.5 | 2017-03-07 | Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multip… |
CVE-2015-7298 | | | 2015-10-26 | ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be i… |
CVE-2015-1860 | | | 2015-05-12 | Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of… |
CVE-2015-1859 | | | 2015-05-12 | Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to ca… |
CVE-2015-1858 | | | 2015-05-12 | Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of… |
CVE-2014-0190 | | | 2014-05-08 | The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values i… |
CVE-2013-4549 | | | 2013-12-23 | QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack. |
CVE-2013-4422 | | | 2013-10-23 | SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitr… |
CVE-2012-6093 | | | 2013-02-24 | The QSslSocket::sslErrors function in Qt before 4.6.5, 4.7.x before 4.7.6, 4.8.x before 4.8.5, when using certain versions of openSSL, uses an "incompatible st… |
CVE-2012-5624 | | | 2013-02-24 | The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitra… |
CVE-2013-0254 | | | 2013-02-06 | The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world… |
CVE-2010-5076 | | | 2012-06-29 | QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-mid… |
CVE-2011-3194 | | | 2012-06-16 | Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause a denial of service (crash) and possibly execute… |
CVE-2011-3193 | | | 2012-06-16 | Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote att… |
CVE-2010-2621 | | | 2010-07-02 | The QSslSocketBackendPrivate::transmit function in src_network_ssl_qsslsocket_openssl.cpp in Qt 4.6.3 and earlier allows remote attackers to cause a denial of… |
CVE-2009-2700 | | | 2009-09-02 | src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field… |
CVE-2007-0242 | | | 2007-04-03 | The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers… |
CVE-2006-4811 | | | 2006-10-18 | Integer overflow in Qt 3.3 before 3.3.7, 4.1 before 4.1.5, and 4.2 before 4.2.1, as used in the KDE khtml library, kdelibs 3.1.3, and possibly other packages… |