Debian

🟡 Medium   ⏱ 10–30 min  Last verified: 8 May 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2021-22204 CVE-2022-23935 CVE-2026-7580 Upstream summary: Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the […]

🟡 Medium   ⏱ 10–30 min  Last verified: 8 May 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2012-0839 CVE-2015-8869 CVE-2017-9779 CVE-2018-9838 CVE-2026-28364 CVE-2026-34353 Upstream summary: OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers […]

🟡 Medium   ⏱ 10–30 min  Last verified: 8 May 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2018-11364 CVE-2018-11365 CVE-2018-5698 Upstream summary: sav_parse_machine_integer_info_record in spss/readstat_sav_read.c in libreadstat.a in ReadStat 0.1.1 has a memory leak related to an iconv_open call. Table of contents Symptom & Impact […]

🟡 Medium   ⏱ 10–30 min  Last verified: 8 May 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2009-3560 CVE-2009-3720 CVE-2012-2090 CVE-2012-2091 CVE-2025-0781 Upstream summary: The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers […]

🟢 Low   ⏱ 5–15 min  Last verified: 7 May 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2026-47372 CVE-2026-47373 Upstream summary: Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable […]

🟠 High   ⏱ 15–60 min  Last verified: 7 May 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2020-0478 CVE-2020-36129 CVE-2020-36130 CVE-2020-36131 CVE-2020-36133 CVE-2020-36135 CVE-2021-30473 CVE-2021-30474  +4 more Upstream summary: In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing […]

🟢 Low   ⏱ 5–15 min  Last verified: 7 May 2026 Affected versions: Debian 13 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2025-58160 Upstream summary: tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection […]

🟢 Low   ⏱ 5–15 min  Last verified: 7 May 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2017-0373 CVE-2017-0374 Upstream summary: The gen_class_pod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model (aka libconfig-model-perl) before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an […]

🟢 Low   ⏱ 5–15 min  Last verified: 7 May 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2015-0854 CVE-2016-10081 Upstream summary: App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Show […]

🟡 Medium   ⏱ 10–30 min  Last verified: 7 May 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2010-2253 CVE-2011-0633 CVE-2026-8368 Upstream summary: lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to […]