CVE Program partner

Qt

Qt Group

API
CVEs, 365 days1010 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationQt Group
RoleCNA
TypeVendor
Reports tomitre
ScopeAll supported Qt Group products. Excludes third-party redistributions and downstream packaging of Qt open source releases not published by Qt Group.
Advisorieshttps://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products

Latest CVEs · RSS

  • CVE-2026-94370 2026-10-14 · CVSS 6.5
    A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::St
  • CVE-2026-19395 2026-10-05 · CVSS 6.6
    In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser
  • CVE-2026-95509 2026-09-29 · CVSS 8.8
    Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-boun
  • CVE-2026-79680 2026-09-24 · CVSS 4.5
    Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that
  • CVE-2026-78253 2026-09-23 · CVSS 2.3
    Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhausti
  • CVE-2026-79616 2026-09-23 · CVSS 0.6
    Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path.
  • CVE-2026-76151 2026-09-16 · CVSS 4.6
    Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 th
  • CVE-2026-19248 2026-09-16 · CVSS 7.1
    QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
  • CVE-2026-13326 2026-09-11 · CVSS 6.9
    An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure
  • CVE-2026-11573 2026-09-08 · CVSS 7.1
    Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePr

All CVE Program partners