Ecosystem
Debian
61,618 known vulnerabilities.
Most affected packages
833 results · Clear filters · Feed
-
High 8.1
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentic…
-
High 7.7CVE-2026-109518 Public exploit
APT RCE via hard link reuse
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…
-
High 8.1CVE-2026-114550 Public exploit
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to expl…
-
High 8.1CVE-2026-54161 Public exploit
upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed…
-
High 8.1
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the s…
KEV Nov 3, 2026 -
High 7.5CVE-2026-116191 Public exploit
Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, …
-
High 7.4CVE-2026-106069 Public exploit
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…
-
High 7.4CVE-2026-105483 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…
-
High 7.4CVE-2026-105482 Public exploit
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …
-
High 7.2CVE-2026-39902 Public exploit
Cacti: Authenticated RCE on Data Input
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_str…
-
High 7.5CVE-2026-113872 Public exploit
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while o…
-
High 7.7CVE-2026-96778 Public exploit
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte b…
-
High 7.8CVE-2026-92183 Public exploit
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that …
-
High 8.1CVE-2026-94300 Public exploit
Concurrent GSS-TSIG messages corrupt memory
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker…
-
High 7.5CVE-2026-97206 Public exploit
DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh…
-
High 7.2CVE-2026-92162 Public exploit
Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local ses…
-
High 7.1CVE-2026-113386 Public exploit
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated a…
-
High 8.1CVE-2026-98499 Public exploit
HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an invalid offset to hid_field_extract(), resulting in memory r…
-
High 8.8CVE-2026-102607 Public exploit
ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters whe…
-
High 7.8CVE-2026-104715 Public exploit
Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sa…
-
High 8.8CVE-2026-110922 Public exploit
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code…
-
High 7.0CVE-2026-53613 Public exploit
util-linux mount target TOCTOU allows local privilege escalation
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before…
-
High 8.1CVE-2026-97205 Public exploit
NGINX ngx_http_core_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a U…
-
High 8.1CVE-2026-15176 Public exploit
NGINX ngx_http_core_module vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achi…
-
High 8.4CVE-2026-86476 Public exploit
Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-che…
-
High 8.1CVE-2026-92392 Public exploit
HTTP/2 upload Use-After-Free
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
-
High 8.1CVE-2026-109722 Public exploit
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 8.1CVE-2026-109715 Public exploit
Incorrect boundary conditions in the JavaScript Engine component
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 7.8CVE-2026-98385 Public exploit
sched/cache: Decouple sched_cache_group from mm to fix UAF
In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple sched_cache_group from mm to fix UAF Currently the sched cache grouping is by mm and the scheduling statistics sched_cache_stat lives in the mm structure. This ties the …
-
High 8.0CVE-2026-107821 Public exploit
MariaDB: insufficient validation of binary frm data when opening a table
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM fi…
-
High 8.1CVE-2026-107181 Public exploit
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme han…
-
High 8.3CVE-2026-106378 Public exploit
Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had comp…
-
High 8.1CVE-2026-82531 Public exploit
Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged S…
-
High 7.8CVE-2026-98260 Public exploit
exec: Cleanup POSIX timers right after de_thread()
In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that threa…
-
High 7.8CVE-2026-98258 Public exploit
posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cpu_timer::firing from a tri…
-
High 7.8CVE-2026-98256 Public exploit
signal: Prevent exec() race
In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec() race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in __send_signal_locked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by tas…
-
High 7.1CVE-2026-98180 Public exploit
drm/msm: RCU-free the scheduler-containing ring and VM objects
In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msm_ringbuffer and struct msm_gem_vm embed a struct drm_gpu_scheduler. msm_ringbuffer_destroy() and the VM free call…
-
High 8.5CVE-2026-63277 Public exploit
RCE via calcext:data-mappings, sql provider and jdbc connector
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that l…
-
High 7.5CVE-2026-63686 Public exploit
Apache HTTP Server: mod_xml2enc crash on charset conversion failure
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds…
-
High 7.5CVE-2026-63292 Public exploit
Apache HTTP Server: mod_vhost_alias stack overflow
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header ex…