🟢 Low ⏱ 5–15 min Last verified: 2 February 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-42338 Upstream summary: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content […]
🟢 Low ⏱ 5–15 min Last verified: 2 February 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2012-5572 CVE-2026-5080 Upstream summary: CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response […]
🟠 High ⏱ 15–60 min Last verified: 31 January 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2017-5645 CVE-2020-9488 CVE-2021-44228 CVE-2021-44832 CVE-2021-45046 CVE-2021-45105 CVE-2025-68161 CVE-2026-34479 +2 more Upstream summary: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server […]
🟠 High ⏱ 15–60 min Last verified: 31 January 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2010-3364 CVE-2018-7998 CVE-2019-6976 CVE-2020-20739 CVE-2021-27847 CVE-2025-29769 CVE-2025-59933 CVE-2026-2913 +8 more Upstream summary: The vips-7.22 script in VIPS 7.22.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows […]
🟡 Medium ⏱ 10–30 min Last verified: 30 January 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2015-8947 CVE-2015-9274 CVE-2016-2052 CVE-2022-33068 CVE-2023-25193 CVE-2026-22693 Upstream summary: hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified […]
🟢 Low ⏱ 5–15 min Last verified: 29 January 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-24358 CVE-2025-47909 Upstream summary: gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin […]
🟢 Low ⏱ 5–15 min Last verified: 28 January 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2020-36659 CVE-2026-8503 Upstream summary: In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration […]
🟢 Low ⏱ 5–15 min Last verified: 27 January 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-7111 Upstream summary: Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption. […]
🟠 High ⏱ 15–60 min Last verified: 26 January 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2019-17545 CVE-2019-17546 CVE-2019-25050 CVE-2021-45943 CVE-2025-29480 CVE-2026-4738 CVE-2026-8084 CVE-2026-8086 +2 more Upstream summary: GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold […]
🟡 Medium ⏱ 10–30 min Last verified: 25 January 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2019-12447 CVE-2019-12448 CVE-2019-12449 CVE-2019-12795 CVE-2019-3827 CVE-2026-28295 CVE-2026-28296 Upstream summary: An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used. […]
