Debian

🟠 High   ⏱ 15–60 min  Last verified: 23 March 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2014-9494 CVE-2014-9649 CVE-2014-9650 CVE-2015-0862 CVE-2015-8786 CVE-2016-9877 CVE-2017-4965 CVE-2017-4966  +12 more Upstream summary: RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header. […]

🟠 High   ⏱ 15–60 min  Last verified: 23 March 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2019-20005 CVE-2019-20006 CVE-2019-20007 CVE-2019-20198 CVE-2019-20199 CVE-2019-20200 CVE-2019-20201 CVE-2019-20202  +12 more Upstream summary: An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted […]

🟡 Medium   ⏱ 10–30 min  Last verified: 23 March 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2024-47515 CVE-2024-47516 CVE-2024-4981 CVE-2024-4982 CVE-2026-3312 Upstream summary: A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the disclosure of local files. […]

🟠 High   ⏱ 15–60 min  Last verified: 23 March 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2013-2503 CVE-2015-1030 CVE-2015-1031 CVE-2015-1380 CVE-2015-1381 CVE-2015-1382 CVE-2016-1982 CVE-2016-1983  +12 more Upstream summary: Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, […]

🟢 Low   ⏱ 5–15 min  Last verified: 23 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2026-24001 Upstream summary: jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the […]

🟡 Medium   ⏱ 10–30 min  Last verified: 23 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2022-23457 CVE-2022-24891 CVE-2025-5878 Upstream summary: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation […]

🟢 Low   ⏱ 5–15 min  Last verified: 23 March 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2011-2201 Upstream summary: The Data::FormValidator module 4.66 and earlier for Perl, when untaint_all_constraints is enabled, does not properly preserve the taint attribute of data, which might allow remote […]

🟢 Low   ⏱ 5–15 min  Last verified: 23 March 2026 Affected versions: Debian 13 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2022-36087 Upstream summary: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause […]

🟡 Medium   ⏱ 10–30 min  Last verified: 23 March 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2023-26920 CVE-2026-25896 CVE-2026-26278 CVE-2026-27942 CVE-2026-33036 CVE-2026-33349 CVE-2026-41650 Upstream summary: fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution. Table of contents Symptom & Impact Environment & Reproduction Root Cause […]

🟢 Low   ⏱ 5–15 min  Last verified: 23 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2026-34591 CVE-2026-41140 Upstream summary: Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes […]