[NEW] [high] WebKitGTK: Multiple vulnerabilities

highCVE-2026-43804 CVE-2026-64713 CVE-2026-64719 CVE-2026-64728 CVE-2026-64730 CVE-2026-64757

A remote, anonymous attacker can exploit multiple vulnerabilities in WebKitGTK to disclose information, bypass security measures, manipulate data, or cause denial-of-service conditions.

CSIRTS triage

vendor: WebKitGTK product: WebKitGTK Information disclosure Authentication bypass Code injection Denial of service

What: Multiple vulnerabilities in WebKitGTK allow remote attackers to disclose information, bypass security measures, manipulate data, or cause denial-of-service.
Who is affected: All deployments of WebKitGTK are affected.
Urgency: High severity; no known exploitation but multiple attack vectors present.
Action: Update WebKitGTK to the patched version immediately.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch WebKitGTK

Get an email when a new WebKitGTK advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-08-25
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2940

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-438040.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-647130.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-647190.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-647280.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-647300.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-647570.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-647830.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-647870.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-289840.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-43804	coverage & exploitation status	NVD · CVE.org
CVE-2026-64713	coverage & exploitation status	NVD · CVE.org
CVE-2026-64719	coverage & exploitation status	NVD · CVE.org
CVE-2026-64728	coverage & exploitation status	NVD · CVE.org
CVE-2026-64730	coverage & exploitation status	NVD · CVE.org
CVE-2026-64757	coverage & exploitation status	NVD · CVE.org
CVE-2026-64783	coverage & exploitation status	NVD · CVE.org
CVE-2026-64787	coverage & exploitation status	NVD · CVE.org
CVE-2026-28984	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Apple macOS, iOS and iPadOS: Multiple vulnerabilitiescert-bund
unknownDSA-6463-1 webkit2gtk - security updatedebian
unknownNCSC-2026-0319 [1.00] [M/H] Vulnerabilities resolved in Apple iOS and iPadOSncsc-nl
unknownNCSC-2026-0317 [1.00] [M/H] Vulnerabilities resolved in Apple macOSncsc-nl
unknownApple Products Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in Apple products (August 18, 2026)cert-fr-avis
mediumCVE-2026-64787: A use-after-free issue was addressed with improved memory management. This issue is fixed in S…nvd
mediumCVE-2026-28984: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and …nvd
medium[NEW] [medium] Apple Safari: Multiple vulnerabilitiescert-bund
medium[NEW] [medium] Apple iOS and iPadOS: Multiple vulnerabilitiescert-bund
unknownNCSC-2026-0266 [1.00] [M/H] Vulnerabilities fixed in Apple iOS and iPadOSncsc-nl
unknownMultiple vulnerabilities in Apple products (July 28, 2026)cert-fr-avis

Recent advisories for WebKitGTK

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

high[NEW] [UNPATCHED] [high] WebKitGTK: Vulnerability allows Code Executioncert-bund · 2026-08-25
medium[NEW] [medium] WebKitGTK: Multiple vulnerabilitiescert-bund · 2026-08-25
highCVE-2026-78376: A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free iss…nvd · 2026-08-24
high[UPDATE] [high] WebKitGTK: Multiple vulnerabilitiescert-bund · 2026-07-24
criticalexploitedCVE-2019-8720: WebKitGTK Memory Corruption Vulnerabilitycisa-kev · 2022-05-23