🟡 Medium ⏱ 10–30 min Last verified: 26 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-11683 CVE-2026-4177 CVE-2026-5089 Upstream summary: YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads […]
🟢 Low ⏱ 5–15 min Last verified: 25 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-45184 Upstream summary: Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used. Table of contents Symptom & Impact Environment & Reproduction Root Cause […]
🟢 Low ⏱ 5–15 min Last verified: 23 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-24001 Upstream summary: jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the […]
🟢 Low ⏱ 5–15 min Last verified: 21 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2020-25860 CVE-2026-34155 Upstream summary: The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update […]
🟡 Medium ⏱ 10–30 min Last verified: 20 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2014-9638 CVE-2014-9639 CVE-2014-9640 CVE-2015-6749 CVE-2017-11331 CVE-2023-43361 CVE-2026-34253 Upstream summary: oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a […]
🟡 Medium ⏱ 10–30 min Last verified: 20 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2011-4617 CVE-2013-1629 CVE-2024-53899 CVE-2026-22702 Upstream summary: virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/. […]
🟡 Medium ⏱ 10–30 min Last verified: 19 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2015-2310 CVE-2015-2311 CVE-2015-2312 CVE-2015-2313 CVE-2017-7892 CVE-2022-46149 CVE-2026-32239 CVE-2026-32240 Upstream summary: Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to […]
🟢 Low ⏱ 5–15 min Last verified: 19 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-33532 Upstream summary: `yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 […]
🟢 Low ⏱ 5–15 min Last verified: 19 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-25765 Upstream summary: Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses […]
🟡 Medium ⏱ 10–30 min Last verified: 18 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2019-17571 CVE-2021-4104 CVE-2022-23302 CVE-2022-23305 CVE-2022-23307 CVE-2026-34480 Upstream summary: Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited […]
