🟡 Medium ⏱ 10–30 min Last verified: 8 May 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2023-0341 CVE-2024-53849 CVE-2026-40489 Upstream summary: A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack […]
🟢 Low ⏱ 5–15 min Last verified: 7 May 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-25537 Upstream summary: jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. […]
🟢 Low ⏱ 5–15 min Last verified: 7 May 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2022-2469 CVE-2026-48829 Upstream summary: GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client Table of contents Symptom & Impact Environment & Reproduction Root Cause Analysis Quick Triage […]
🟢 Low ⏱ 5–15 min Last verified: 6 May 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-34531 Upstream summary: Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to […]
🟠 High ⏱ 15–60 min Last verified: 6 May 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2017-11509 CVE-2017-6369 CVE-2025-54989 CVE-2025-65104 CVE-2026-27890 CVE-2026-28212 CVE-2026-28214 CVE-2026-28224 +4 more Upstream summary: An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 […]
🟡 Medium ⏱ 10–30 min Last verified: 5 May 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2019-14853 CVE-2019-14859 CVE-2024-23342 CVE-2026-33936 Upstream summary: An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no […]
🟡 Medium ⏱ 10–30 min Last verified: 3 May 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2017-17042 CVE-2019-1020001 CVE-2024-27285 CVE-2026-41493 Upstream summary: lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to […]
🟡 Medium ⏱ 10–30 min Last verified: 3 May 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-46734 CVE-2026-30838 CVE-2026-33347 Upstream summary: league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) […]
🟢 Low ⏱ 5–15 min Last verified: 3 May 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-42627 Upstream summary: In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger […]
🟢 Low ⏱ 5–15 min Last verified: 3 May 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-42338 Upstream summary: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content […]
