🟡 Medium ⏱ 10–30 min Last verified: 2 April 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2019-12209 CVE-2019-12210 CVE-2021-31924 CVE-2025-23013 Upstream summary: Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify […]
🟡 Medium ⏱ 10–30 min Last verified: 1 April 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2020-36407 CVE-2025-48174 CVE-2025-48175 Upstream summary: libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid. Table of contents Symptom & Impact Environment & Reproduction Root Cause Analysis Quick […]
🟢 Low ⏱ 5–15 min Last verified: 1 April 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-44312 Upstream summary: css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker […]
🟢 Low ⏱ 5–15 min Last verified: 31 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-32725 CVE-2026-32726 Upstream summary: SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an […]
🟠 High ⏱ 15–60 min Last verified: 30 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2019-14751 CVE-2021-3828 CVE-2021-3842 CVE-2021-43854 CVE-2024-39705 CVE-2025-14009 CVE-2026-0846 CVE-2026-0847 +4 more Upstream summary: NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files […]
🟡 Medium ⏱ 10–30 min Last verified: 30 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2023-29159 CVE-2023-30798 CVE-2024-47874 CVE-2025-54121 CVE-2026-48710 Upstream summary: Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files […]
🟡 Medium ⏱ 10–30 min Last verified: 29 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2024-37568 CVE-2025-59420 CVE-2025-61920 CVE-2025-62706 CVE-2025-68158 CVE-2026-27962 CVE-2026-28490 CVE-2026-28498 Upstream summary: lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a […]
🟡 Medium ⏱ 10–30 min Last verified: 29 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2015-1833 CVE-2016-6801 CVE-2023-37895 CVE-2025-53689 CVE-2025-58782 Upstream summary: XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before […]
🟡 Medium ⏱ 10–30 min Last verified: 27 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2016-10164 CVE-2022-44617 CVE-2022-46285 CVE-2022-4883 CVE-2023-43788 CVE-2023-43789 CVE-2026-4367 Upstream summary: Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow […]
🟢 Low ⏱ 5–15 min Last verified: 27 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-32141 CVE-2026-33228 Upstream summary: flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. […]
