🟡 Medium ⏱ 10–30 min Last verified: 6 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2014-10064 CVE-2014-7191 CVE-2022-24999 CVE-2025-15284 CVE-2026-2391 CVE-2026-8723 Upstream summary: The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a […]
🟡 Medium ⏱ 10–30 min Last verified: 5 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2014-3529 CVE-2014-3574 CVE-2014-9527 CVE-2016-5000 CVE-2017-12626 CVE-2017-5644 CVE-2019-12415 CVE-2025-31672 Upstream summary: The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an […]
🟢 Low ⏱ 5–15 min Last verified: 5 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-21452 Upstream summary: MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects […]
🟢 Low ⏱ 5–15 min Last verified: 5 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-34297 CVE-2026-41445 Upstream summary: KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft […]
🟢 Low ⏱ 5–15 min Last verified: 5 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-40918 Upstream summary: Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely. The cnonce (client nonce) is generated from an MD5 hash of the PID, the […]
🟢 Low ⏱ 5–15 min Last verified: 4 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2021-42740 CVE-2026-9277 Upstream summary: The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows […]
🟢 Low ⏱ 5–15 min Last verified: 2 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-68146 CVE-2026-22701 Upstream summary: filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or […]
🟢 Low ⏱ 5–15 min Last verified: 2 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2021-42343 CVE-2026-23528 Upstream summary: An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults […]
🟡 Medium ⏱ 10–30 min Last verified: 1 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2018-21232 CVE-2020-11958 CVE-2022-23901 CVE-2026-2903 Upstream summary: re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags. Table of contents Symptom & Impact Environment & Reproduction Root […]
🟡 Medium ⏱ 10–30 min Last verified: 28 February 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2010-1160 CVE-2010-1161 CVE-2024-5742 CVE-2026-6842 CVE-2026-6843 Upstream summary: GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation, […]
