Lynx Project maintains a text-based web browser with a compact, legacy codebase that persists in specialized environments including terminal-based systems and accessibility contexts. Its observed vulnerability classes center on credential handling, origin validation, and memory-safety issues characteristic of C-based software with long maintenance cycles. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Lynx Project over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-4690HIGH lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: UR | Oct 22, 2008 | 10.0 | 29 | NO | NO |
CVE-2014-5002HIGH The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes. | Jan 10, 2018 | 7.8 | 25 | NO | NO |
CVE-2021-38165MEDIUM Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data. | Aug 7, 2021 | 5.3 | 22 | NO | NO |
CVE-2010-2810MEDIUM Heap-based buffer overflow in the convert_to_idna function in WWW/Library/Implementation/HTParse.c in Lynx 2.8.8dev.1 through 2.8.8dev.4 allows remote attackers to cause a denial o | Aug 20, 2010 | 6.8 | 21 | NO | NO |
CVE-2006-7234MEDIUM Untrusted search path vulnerability in Lynx before 2.8.6rel.4 allows local users to execute arbitrary code via malicious (1) .mailcap and (2) mime.types files in the current workin | Oct 27, 2008 | 4.6 | 21 | NO | YES |
CVE-2017-1000211MEDIUM Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTML_put_string() can append a chunk onto itself. | Nov 17, 2017 | 5.3 | 20 | NO | NO |
CVE-2016-9179HIGH lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a dif | Dec 22, 2016 | 7.5 | 20 | NO | NO |
CVE-2012-5821MEDIUM Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certi | Nov 4, 2012 | 5.9 | 20 | NO | NO |
CVE-1999-1549HIGH Lynx 2.x does not properly distinguish between internal and external HTML, which may allow a local attacker to read a "secure" hidden form value from a temporary file and craft a L | Nov 16, 1999 | 7.8 | 20 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Lynx Project.
Media articles that mention a CVE ID that affects a product developed by Lynx Project — matched by CVE ID, not by vendor name.