Gnome Evolution-Data-Server vulnerabilities

4 CVEs affecting Gnome Evolution-Data-Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-110777, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-14928, published 2020-07-17. Medium severity, CVSS 5.9. EPSS: 2.8% chance of exploitation in the next 30 days. evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS…
CVE-2009-0582, published 2009-03-14. Medium severity, CVSS 5.8. EPSS: 2.3% chance of exploitation in the next 30 days. The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and…
CVE-2020-16117, published 2020-07-29. Medium severity, CVSS 5.9. EPSS: 2.1% chance of exploitation in the next 30 days. In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection…
CVE-2026-110777, published 2026-10-14. Medium severity, CVSS 5.7. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back…