Debian

Products

Exploited and recent CVEs

• CVE-2022-0543 Critical 10.0 Exploited It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. 99.4%
• CVE-2026-109518 High 7.7 APT RCE via hard link reuse 0.9%
• CVE-2026-89169 Medium 4.1 live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. 0.1%
• CVE-2026-77118 High 8.4 Out-of-bounds write in GraphicsMagick PCD decoder 0.2%
• CVE-2026-11853 Medium 6.5 Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages (.dsc) and upload artifacts (.changes) are manifest files that name the files t 0.3%
• CVE-2026-11852 Medium 6.5 Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debusine are organized into artifacts. The endpoints that create and delete relations 0.2%
• CVE-2026-2219 High 7.5 It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, whi 0.5%
• CVE-2025-68462 Low 3.2 Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases. 0.1%
• CVE-2025-8454 Critical 9.8 It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier 0.3%
• CVE-2025-6297 High 8.2 dpkg-deb: Fix cleanup for control member with restricted directories 0.5%
• CVE-2025-53391 Critical 9.3 The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactive/allow_active settings that allow a local user to escalate 0.2%
• CVE-2025-47153 Medium 6.5 Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e. 0.4%
• CVE-2024-2312 Medium 6.7 GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to a use-after-free condition, and could po 0.4%
• CVE-2023-7207 Medium 4.9 Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provide 0.9%
• CVE-2022-2787 Unrated stricter rules on chroot names 1.0%
• CVE-2022-1664 Unrated directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar 3.2%
• CVE-2021-20001 Unrated It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the user web shares (~/public_html), which cou 1.6%
• CVE-2020-3811 Unrated qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability. 1.8%
• CVE-2020-3812 Unrated qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail 0.4%
• CVE-2020-3810 Unrated Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files. 1.3%