Debian vulnerabilities

Products

• Linux 10,013
• Advanced Package Tool 21
• Dpkg 14
• Pdns 14
• Shadow 8
• Apt 7
• Lintian 6
• Devscripts 3
• Horde 3
• Icoutils 3
• Reportbug 3
• Apt-cacher 2
• Aptlinex 2
• Cifs-utils 2
• Debusine 2
• Dpkg-dev 2
• Freedombox 2
• Fsp 2
• Horde Groupware 2
• Mime-support 2
• Netkit 2
• Netqmail 2
• Python-apt 2
• Python-dns 2
• Qpopper 2
• Xsabre 2
• Yubiserver 2

Newest

• debian live-boot live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection... CVE-2026-89169 4.1 MediumSeptember 11, 2026
• debian graphicsmagick Out-of-bounds write in GraphicsMagick PCD decoder CVE-2026-77118 Fix available 8.4 HighAugust 20, 2026
• php, debian linux +1 more ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD CVE-2026-14355 Fix available 5.6 MediumJuly 3, 2026
• openvpn, debian linux +1 more A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote... CVE-2026-12996 Fix available 6.0 MediumJuly 3, 2026
• gnu sasl, debian linux +1 more GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the... CVE-2026-56968 Fix available 3.7 LowJune 23, 2026
• debian debusine Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution.... CVE-2026-11853 Fix available 6.5 MediumJune 10, 2026
• debian debusine Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution.... CVE-2026-11852 Fix available 6.5 MediumJune 10, 2026
• apache http server, debian linux, red hat jboss core services for rhel 8 +19 more +21 more Apache HTTP Server: mod_http2 denial of service CVE-2026-49975 Public exploitFix available EPSS 33.0% 7.5 HighJune 3, 2026
• f5 nginx open source, nginx plus, debian linux +15 more +17 more NGINX ngx_http_rewrite_module vulnerability CVE-2026-9256 Public exploitFix available EPSS 10.9% 9.2 CriticalMay 22, 2026
• debian linux, linux kernel, red hat nvidia for rhel 10 +23 more +25 more ptrace: slightly saner 'get_dumpable()' logic CVE-2026-46333 Public exploitFix available 7.1 HighMay 15, 2026
• andybalholm brotli, 7-zip p7zip, anthropic bun +34 more +36 more Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 In KEVPublic exploitFix available EPSS 82.6% 9.2 CriticalApril 27, 2026
• amazon linux, linux kernel, arista cloudvision agni +142 more +144 more crypto: algif_aead - Revert to operating out-of-place CVE-2026-31431 In KEVPublic exploitFix available EPSS 98.1% 7.8 HighApril 22, 2026
• ocaml opam, debian linux, red hat enterprise linux 10 +1 more +3 more In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to... CVE-2026-41082 Fix available 7.3 HighApril 15, 2026
• libpng, debian linux +1 more LIBPNG has a yse-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST leading to corrupted chunk data and potential heap information disclosure CVE-2026-34757 Fix available 5.1 MediumApril 9, 2026
• libtiff, debian linux, red hat ai inference server 3.2 +30 more +32 more Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing CVE-2026-4775 Fix available 7.8 HighMarch 24, 2026
• gstreamer, debian linux, freedesktop gst-plugins-good +6 more +8 more Gstreamer: incomplete fix of cve-2026-1940 CVE-2026-1940 Fix available 5.1 MediumMarch 23, 2026
• awstats, debian linux +1 more AWStats 8.0 is vulnerable to Command Injection via the open function CVE-2025-63261 Fix available 7.8 HighMarch 20, 2026
• debian linux, openbsd openssh, canonical ubuntu linux +37 more +39 more Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This... CVE-2026-3497 Fix available 2.7 LowMarch 12, 2026
• debian dpkg It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does... CVE-2026-2219 Fix available 7.5 HighMarch 7, 2026
• dun munge, debian linux, red hat ai inference server 3.3 +16 more +18 more MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery CVE-2026-25506 Fix available 7.7 HighFebruary 10, 2026
• eprosima fast-dds, fast dds, debian linux +2 more FastDDS has Out-of-memory in readOctetVector via Manipulated DATA Submessage when DDS Security is enabled CVE-2025-64098 1.7 LowFebruary 3, 2026
• eprosima fast-dds, fast dds, debian linux +2 more FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE) CVE-2025-62799 7.2 HighFebruary 3, 2026
• eprosima fast dds, debian linux, eprosima fast-dds +2 more FastDDS has Out-of-memory while parsing GenericMessage when DDS Security is enabled CVE-2025-62603 1.7 LowFebruary 3, 2026
• eprosima fast-dds, fast dds, debian linux +2 more FastDDS has heap buffer overflow in readData via Manipulated DATA Submessage when DDS Security is enabled CVE-2025-62602 1.7 LowFebruary 3, 2026
• eprosima fast-dds, fast dds, debian linux +2 more eprosima Fast DDS affected by Out-of-Memory in readBinaryPropertySeq via Manipulated DATA Submessage when DDS Security is enabled CVE-2025-62600 8.6 HighFebruary 3, 2026
• eprosima fast-dds, fast dds, debian linux +2 more eprosima Fast DDS affected by Out-of-Memory in readPropertySeq via Manipulated DATA Submessage when DDS Security is enabled CVE-2025-62599 8.6 HighFebruary 3, 2026
• digitalcorpora tcpflow, debian linux +1 more tcpflow has TIM Element OOB Write in wifipcap CVE-2026-25061 Fix available 5.5 MediumJanuary 29, 2026
• phpunit project phpunit, debian linux +1 more PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling CVE-2026-24765 Fix available 7.8 HighJanuary 27, 2026
• neutrinolabs xrdp, debian linux +1 more xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow CVE-2025-68670 Fix available 9.1 CriticalJanuary 27, 2026
• gnu inetutils, debian linux +1 more telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value... CVE-2026-24061 In KEVPublic exploitFix available EPSS 99.0% 9.8 CriticalJanuary 21, 2026
• pyasn1, debian linux, red hat lightspeed core +48 more +50 more pyasn1 has a DoS vulnerability in decoder CVE-2026-23490 Fix available 7.5 HighJanuary 16, 2026
• net-snmp, debian linux +1 more Net-SNMP snmptrapd crash CVE-2025-68615 Fix available EPSS 42.4% 9.8 CriticalDecember 22, 2025
• debian freedombox Freedombox before 25.17.1 does not set proper permissions for the backups-data directory,... CVE-2025-68462 Fix available 3.2 LowDecember 18, 2025
• canonical python-apt, debian linux +1 more Null-pointer dereference in python-apt TagSection.keys() CVE-2025-6966 Fix available 6.9 MediumDecember 5, 2025
• alinto sogo, debian linux +1 more alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter. CVE-2025-63498 Public exploitFix available 6.1 MediumNovember 24, 2025
• pdfminer pdfminer.six, debian linux +1 more pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input CVE-2025-64512 Public exploitFix available 8.6 HighNovember 7, 2025
• gimp, debian linux +1 more GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2025-10934 Fix available 7.8 HighOctober 29, 2025
• x.org x server, debian linux, ibm aix +25 more +27 more Xorg: xmayland: value overflow in xkbsetcompatmap() CVE-2025-62231 Fix available 7.3 HighOctober 28, 2025
• x.org x server, xwayland, debian linux +25 more +27 more Xorg: xwayland: use-after-free in xkb client resource removal CVE-2025-62230 Fix available 7.3 HighOctober 28, 2025
• gimp, debian linux +1 more GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2025-10921 Fix available 7.8 HighOctober 3, 2025
• debian linux, linux kernel +1 more dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees CVE-2025-39923 Fix available 5.5 MediumOctober 1, 2025
• debian linux, linux kernel +1 more pcmcia: Add error handling for add_interval() in do_validate_mem() CVE-2025-39920 Fix available 5.5 MediumOctober 1, 2025
• debian linux, linux kernel +1 more mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() CVE-2025-39916 Fix available 5.5 MediumOctober 1, 2025
• debian linux, linux kernel +1 more tracing: Silence warning when chunk allocation fails in trace_pid_write CVE-2025-39914 Fix available 5.5 MediumOctober 1, 2025
• debian linux, linux kernel, siemens ruggedcom rst2428p +2 more tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. CVE-2025-39913 Public exploitFix available 7.8 HighOctober 1, 2025
• debian linux, linux kernel +1 more i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path CVE-2025-39911 Fix available 7.8 HighOctober 1, 2025
• debian linux, linux kernel +1 more mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() CVE-2025-39909 Fix available 5.5 MediumOctober 1, 2025
• debian linux, linux kernel +1 more mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer CVE-2025-39907 Fix available 5.5 MediumOctober 1, 2025
• debian linux, linux kernel +1 more mm/slub: avoid accessing metadata when pointer is invalid in object_err() CVE-2025-39902 Fix available 7.1 HighOctober 1, 2025
• debian linux, linux kernel +1 more netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm CVE-2025-39894 Fix available 7.5 HighOctober 1, 2025
• Show olderLoading…