Vendor
Debian
30 known vulnerabilities.
Debian at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 2 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 1 | 0 |
| Aug 2026 | 1 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 2 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 1 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 1 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 1 | 1 |
| Jul 2025 | 1 | 0 |
| Jun 2025 | 2 | 2 |
| May 2025 | 1 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
Medium max 5.4
LibreOffice: Schwachstelle ermöglicht Denial-of-Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in LibreOffice ausnutzen, um einen Denial-of-Service-Angriff durchzuführen.
first Nov 5, 2026 -
High max 7.7
Squid: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Squid ausnutzen, um einen Denial of Service Angriff durchzuführen, um beliebigen Programmcode auszuführen und um Sicherheitsvorkehrungen zu umgehen.
first Sep 13, 2026 -
High max 8.2
OpenSSL: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren und einen Denial-of-Service-Zustand zu verursachen.
first Sep 29, 2026 -
High max 9.8
Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox ESR, Mozilla Firefox und Thunderbird ausnutzen, um beliebigen Programmcode auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, einen D…
first Sep 29, 2026 -
High max 9.2
CPython: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Python ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
first Oct 1, 2026
30 results · Feed
-
High 8.4
In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting …
-
High 7.7CVE-2026-109518 Public exploit
APT RCE via hard link reuse
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…
-
Medium 4.1
live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .ve…
-
High 8.4
Out-of-bounds write in GraphicsMagick PCD decoder
A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated…
-
Medium 6.5
Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source package…
-
Medium 6.5
Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debu…
-
High 7.5
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate …
-
Low 3.2
Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump …
-
Critical 9.8
It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscript…
-
High 8.2
dpkg-deb: Fix cleanup for control member with restricted directories
It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behi…
-
Critical 9.3
The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit al…
-
Critical 9.8
pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered th…
-
Medium 6.5
Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_…
-
Medium 6.7
GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI sys…
-
Medium 4.9
Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches whi…
-
Unscored —
stricter rules on chroot names
Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session.
-
Unscored —
directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar
Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a …
-
Unscored —
duck before 0.10 did not properly handle loading of untrusted code from the current directory.
-
Critical 10.0
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specifi…
KEV Mar 28, 2022 -
Unscored —
It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 c…
-
Unscored —
qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.
-
Unscored —
qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test fo…
-
Unscored —
Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service wh…
-
Unscored —
The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a p…
-
Unscored —
Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.2…
-
Unscored —
The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, w…
-
Unscored —
Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to …
-
Unscored —
Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 a…
-
High 7.5
Backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858
The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages fr…
-
Critical 9.8
diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.