Debian - vulnerabilities (CVEs)

10169 CVEs in 134 products, 1 in the last 30 days, newest from 2026-10-22.

Products

• Debian Linux - 10014 CVEs
• Advanced Package Tool - 21 CVEs
• Dpkg - 14 CVEs
• Shadow - 8 CVEs
• Lintian - 6 CVEs
• Apt - 5 CVEs
• Devscripts - 3 CVEs
• Horde - 3 CVEs
• Icoutils - 3 CVEs
• Reportbug - 3 CVEs
• Apt-cacher - 2 CVEs
• Aptlinex - 2 CVEs
• Cifs-utils - 2 CVEs
• Debusine - 2 CVEs
• Dpkg-dev - 2 CVEs
• Freedombox - 2 CVEs
• Fsp - 2 CVEs
• Horde Groupware - 2 CVEs
• Mime-support - 2 CVEs
• Netkit - 2 CVEs
• Netqmail - 2 CVEs
• Python-apt - 2 CVEs
• Python-dns - 2 CVEs
• Qpopper - 2 CVEs
• Xsabre - 2 CVEs
• Yubiserver - 2 CVEs
• Adequate - 1 CVEs
• Amaya - 1 CVEs
• Apache - 1 CVEs
• Apache2 - 1 CVEs
• Apt-listchanges - 1 CVEs
• Apt-setup - 1 CVEs
• As Dcp Lib - 1 CVEs
• Axiom - 1 CVEs
• Backupninja - 1 CVEs
• Base-config - 1 CVEs
• Bind9 - 1 CVEs
• Bsdmainutils - 1 CVEs
• Bsmtpd - 1 CVEs
• Cfingerd - 1 CVEs
• Citadel Server - 1 CVEs
• Courier-authlib - 1 CVEs
• Cron - 1 CVEs
• Crossroads - 1 CVEs
• Dbd-firebird - 1 CVEs
• Debian-edu-config - 1 CVEs
• Debian-goodies - 1 CVEs
• Debian-lan-config - 1 CVEs
• Debian Based Gnu Grub - 1 CVEs
• Debian Cpio - 1 CVEs
• Debian Edu - 1 CVEs
• Debmake - 1 CVEs
• Debmany - 1 CVEs
• Devotee - 1 CVEs
• Diffoscope - 1 CVEs
• Dpkg-cross - 1 CVEs
• Duck - 1 CVEs
• Duplicity - 1 CVEs
• Elvis Tiny - 1 CVEs
• Exuberant Ctags - 1 CVEs
• Feta - 1 CVEs
• Ftpsync - 1 CVEs
• Fuse - 1 CVEs
• Gfax - 1 CVEs
• Guilt - 1 CVEs
• Hivex - 1 CVEs
• Honeyd Common - 1 CVEs
• Horde Imp - 1 CVEs
• Initramfs-tools - 1 CVEs
• Internet Message - 1 CVEs
• Kde4libs - 1 CVEs
• Kernel-patch-vserver - 1 CVEs
• Latd - 1 CVEs
• Libdbd-pg-perl - 1 CVEs
• Libmail-audit-perl - 1 CVEs
• Live-boot - 1 CVEs
• Localepurge - 1 CVEs
• Logcheck - 1 CVEs
• Logol - 1 CVEs
• Ltp - 1 CVEs
• Mailscanner - 1 CVEs
• Matplotlib - 1 CVEs
• Mono-debugger - 1 CVEs
• Most - 1 CVEs
• Myspell - 1 CVEs
• Netstd - 1 CVEs
• Newsgate - 1 CVEs
• Nss-ldap - 1 CVEs
• Os-prober - 1 CVEs
• Overkill - 1 CVEs
• Pdns - 1 CVEs
• Perm - 1 CVEs
• Php5-common - 1 CVEs
• Phpbb3 - 1 CVEs
• Postgresql-common - 1 CVEs
• Ppthtml - 1 CVEs
• Ppxp - 1 CVEs
• Projectl - 1 CVEs
• Pycode-browser - 1 CVEs
• Pyftpd - 1 CVEs
• Python-imaging - 1 CVEs
• Redis - 1 CVEs
• Reprepro - 1 CVEs
• Schroot - 1 CVEs
• Sgml-tools - 1 CVEs
• Strongswan - 1 CVEs
• Sympa - 1 CVEs
• Syncevolution - 1 CVEs
• Tetex-bin - 1 CVEs
• Tex-common - 1 CVEs
• Texlive-extra-utils - 1 CVEs
• Tin - 1 CVEs
• Tmpreaper - 1 CVEs
• Toolchain-source - 1 CVEs
• Tor - 1 CVEs
• Trixie - 1 CVEs
• Tss - 1 CVEs
• Turba - 1 CVEs
• Txt2man - 1 CVEs
• Unattended-upgrades - 1 CVEs
• Unp - 1 CVEs
• X11-common - 1 CVEs
• Xbindkeys-config - 1 CVEs
• Xbuffy - 1 CVEs
• Zulucrypt - 1 CVEs
• Dhcpdump - 0 CVEs
• Iceape - 0 CVEs
• Ifupdown - 0 CVEs
• Ldapscripts - 0 CVEs
• Linux - 0 CVEs
• Mit Kerberos - 0 CVEs
• Mit Openafs - 0 CVEs
• Shadow-utils - 0 CVEs
• Trousers - 0 CVEs

Newest CVEs of Debian

• CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
• CVE-2026-89169 - CVSS 4.1 (medium), 2026-09-11: live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.
• CVE-2026-77118 - CVSS 8.4 (high), 2026-08-20: A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output…
• CVE-2026-12996 - CVSS 8.1 (high), 2026-07-30: A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or…
• CVE-2026-14355 - CVSS 5.6 (medium), 2026-07-03: In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL…
• CVE-2026-56968 - CVSS 5.3 (medium), 2026-06-23: GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a…
• CVE-2026-11853 - CVSS 6.5 (medium), 2026-06-10: Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages (.dsc) and upload artifacts…
• CVE-2026-11852 - CVSS 6.5 (medium), 2026-06-10: Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debusine are organized into artifacts. The…
• CVE-2026-49975 - CVSS 7.5 (high), 2026-06-08: Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue…
• CVE-2026-9256 - CVSS 9.2 (critical), 2026-05-22: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex…
• CVE-2026-46333 - CVSS 7.8 (high), 2026-05-15: In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally…
• CVE-2026-31431 - CVSS 7.8 (high), 2026-04-22: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit…
• CVE-2026-41082 - CVSS 7.8 (high), 2026-04-16: In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
• CVE-2026-34757 - CVSS 5.1 (medium), 2026-04-09: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to…
• CVE-2026-4775 - CVSS 7.8 (high), 2026-03-24: A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by…
• CVE-2026-1940 - CVSS 7.5 (high), 2026-03-23: An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 >…
• CVE-2025-63261 - CVSS 7.8 (high), 2026-03-20: AWStats 8.0 is vulnerable to Command Injection via the open function
• CVE-2026-3497 - CVSS 8.2 (high), 2026-03-12: Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux…
• CVE-2026-2219 - CVSS 7.5 (high), 2026-03-07: It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when…
• CVE-2026-25506 - CVSS 7.8 (high), 2026-02-10: MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow…
• CVE-2025-64098 - CVSS 5.9 (medium), 2026-02-03: Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and…
• CVE-2025-62602 - CVSS 7.5 (high), 2026-02-03: Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and…
• CVE-2025-62603 - CVSS 7.5 (high), 2026-02-03: Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). ParticipantGenericMessage is the DDS…
• CVE-2025-62799 - CVSS 9.8 (critical), 2026-02-03: Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and…
• CVE-2025-62600 - CVSS 8.6 (high), 2026-02-03: eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6,…
• CVE-2025-62599 - CVSS 8.6 (high), 2026-02-03: eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6,…
• CVE-2026-25061 - CVSS 7.5 (high), 2026-01-29: tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame elements and performs a length check…
• CVE-2026-24765 - CVSS 7.8 (high), 2026-01-27: PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe…
• CVE-2025-68670 - CVSS 9.8 (critical), 2026-01-27: xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper…
• CVE-2026-24061 - CVSS 9.8 (critical), 2026-01-21: telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.