Gnome Evolution Data Server vulnerabilities

2 CVEs affecting Gnome Evolution Data Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-2604, published 2026-06-17.

More from Gnome.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2013-4166, published 2020-02-06. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email…
• CVE-2026-2604, published 2026-06-17. Medium severity, CVSS 5.6. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory…