🟢 Low ⏱ 5–15 min Last verified: 19 June 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2021-23358 CVE-2026-27601 Upstream summary: The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly […]
🟡 Medium ⏱ 10–30 min Last verified: 18 June 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-46734 CVE-2026-30838 CVE-2026-33347 Upstream summary: league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) […]
🟢 Low ⏱ 5–15 min Last verified: 18 June 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-68146 CVE-2026-22701 Upstream summary: filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or […]
🟢 Low ⏱ 5–15 min Last verified: 17 June 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-5958 Upstream summary: When sed is invoked with both -i (in-place edit) and –follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: 1. […]
🟢 Low ⏱ 5–15 min Last verified: 17 June 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-29366 CVE-2025-9688 Upstream summary: In mupen64plus v2.6.0 there is an array overflow vulnerability in the write_rdram_regs and write_rdram_regs functions, which enables executing arbitrary commands on the host machine. […]
🟢 Low ⏱ 5–15 min Last verified: 17 June 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-9288 Upstream summary: Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11. Table of contents Symptom & Impact Environment & Reproduction Root […]
🟡 Medium ⏱ 10–30 min Last verified: 16 June 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2016-2175 CVE-2018-11797 CVE-2018-8036 CVE-2021-31811 CVE-2021-31812 CVE-2026-23907 CVE-2026-33929 Upstream summary: Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers […]
🟢 Low ⏱ 5–15 min Last verified: 16 June 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-32952 Upstream summary: go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out […]
🟡 Medium ⏱ 10–30 min Last verified: 15 June 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-42476 CVE-2026-42477 CVE-2026-42478 CVE-2026-42479 CVE-2026-42480 CVE-2026-42481 Upstream summary: Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 exist in RWStl_Reader::ReadAscii […]
🟢 Low ⏱ 5–15 min Last verified: 15 June 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-33186 Upstream summary: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` […]
