Debian

🟢 Low   ⏱ 5–15 min  Last verified: 16 March 2026 Affected versions: Debian 13 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2024-28820 Upstream summary: Buffer overflow in the extract_openvpn_cr function in openvpn-cr.c in openvpn-auth-ldap (aka the Three Rings Auth-LDAP plugin for OpenVPN) 2.0.4 allows attackers with a valid LDAP username […]

🟡 Medium   ⏱ 10–30 min  Last verified: 16 March 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2016-5537 CVE-2018-17191 CVE-2019-17560 CVE-2019-17561 CVE-2020-11986 Upstream summary: Unspecified vulnerability in the NetBeans component in Oracle Fusion Middleware 8.1 allows local users to affect confidentiality, integrity, and availability via […]

🟢 Low   ⏱ 5–15 min  Last verified: 16 March 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2016-7793 CVE-2016-7794 Upstream summary: sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository URL. Table of contents Symptom & Impact Environment & […]

🟢 Low   ⏱ 5–15 min  Last verified: 16 March 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2026-42052 Upstream summary: Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode <%= … %> for untrusted […]

🟡 Medium   ⏱ 10–30 min  Last verified: 16 March 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2005-2096 CVE-2005-2995 CVE-2007-5626 CVE-2008-5373 CVE-2012-4430 CVE-2020-11061 Upstream summary: zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream […]

🟢 Low   ⏱ 5–15 min  Last verified: 16 March 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2008-4979 Upstream summary: getipacctg in rancid 2.3.2~a8 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/ipacct.#####.prefixes, (2) /tmp/ipacct.#####.sorted, (3) /tmp/ipacct.#####.pl, and (4) /tmp/ipacct.##### […]

🟢 Low   ⏱ 5–15 min  Last verified: 16 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2026-26198 CVE-2026-27953 Upstream summary: Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing […]

🟡 Medium   ⏱ 10–30 min  Last verified: 16 March 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2023-40826 CVE-2023-40827 CVE-2023-40828 CVE-2025-70952 Upstream summary: An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the […]

🟢 Low   ⏱ 5–15 min  Last verified: 16 March 2026 Affected versions: Debian 13 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2021-23792 Upstream summary: The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker […]

🟢 Low   ⏱ 5–15 min  Last verified: 15 March 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read  •  Source: Debian Security Tracker Related CVEs: CVE-2025-66506 CVE-2026-22772 Upstream summary: Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via […]