🟠 High ⏱ 15–60 min Last verified: 19 November 2025 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2002-0847 CVE-2011-1499 CVE-2011-1843 CVE-2012-3505 CVE-2017-11747 CVE-2022-40468 CVE-2023-49606 CVE-2025-63938 +2 more Upstream summary: tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory […]
🟢 Low ⏱ 5–15 min Last verified: 17 November 2025 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2012-0065 CVE-2025-66004 Upstream summary: Heap-based buffer overflow in the receive_packet function in libusbmuxd/libusbmuxd.c in usbmuxd 1.0.5 through 1.0.7 allows physically proximate attackers to execute arbitrary code via a […]
🟢 Low ⏱ 5–15 min Last verified: 16 November 2025 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-11687 Upstream summary: A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie […]
🟢 Low ⏱ 5–15 min Last verified: 15 November 2025 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2020-27638 CVE-2025-24356 Upstream summary: receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code. Table of contents Symptom & […]
🟢 Low ⏱ 5–15 min Last verified: 13 November 2025 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-66453 Upstream summary: Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float […]
🟢 Low ⏱ 5–15 min Last verified: 11 November 2025 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2025-7962 Upstream summary: In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. Table of […]
🟠 High ⏱ 15–60 min Last verified: 9 November 2025 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2012-2374 CVE-2013-2099 CVE-2014-9720 CVE-2023-28370 CVE-2024-52804 CVE-2025-47287 CVE-2025-67724 CVE-2025-67725 +3 more Upstream summary: CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject […]
🟡 Medium ⏱ 10–30 min Last verified: 7 November 2025 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2017-17689 CVE-2017-9604 CVE-2018-19516 CVE-2019-10732 CVE-2021-31855 CVE-2025-69412 Upstream summary: The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. […]
🟢 Low ⏱ 5–15 min Last verified: 1 November 2025 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2012-6687 CVE-2025-23016 Upstream summary: FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of […]
🟡 Medium ⏱ 10–30 min Last verified: 31 October 2025 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2021-42521 CVE-2025-57106 CVE-2025-57107 CVE-2025-57108 CVE-2025-57109 Upstream summary: There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the […]
