🟢 Low ⏱ 5–15 min Last verified: 9 June 2026 Affected versions: Debian 13 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2014-5260 Upstream summary: The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary […]
🟡 Medium ⏱ 10–30 min Last verified: 9 June 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2020-36049 CVE-2023-32695 CVE-2026-33151 Upstream summary: socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used. […]
🟡 Medium ⏱ 10–30 min Last verified: 9 June 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2019-19391 CVE-2020-15890 CVE-2020-24372 CVE-2024-25176 CVE-2024-25177 CVE-2024-25178 Upstream summary: In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that […]
🟢 Low ⏱ 5–15 min Last verified: 9 June 2026 Affected versions: Debian 13 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2022-21698 Upstream summary: client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior […]
🟢 Low ⏱ 5–15 min Last verified: 9 June 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-31072 Upstream summary: The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function […]
🟡 Medium ⏱ 10–30 min Last verified: 9 June 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2022-23457 CVE-2022-24891 CVE-2025-5878 Upstream summary: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation […]
🟡 Medium ⏱ 10–30 min Last verified: 9 June 2026 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2018-25099 CVE-2025-40912 CVE-2025-40914 CVE-2026-41564 Upstream summary: In the CryptX module before 0.062 for Perl, gcm_decrypt_verify() and chacha20poly1305_decrypt_verify() do not verify the tag. Table of contents Symptom & Impact […]
🟢 Low ⏱ 5–15 min Last verified: 8 June 2026 Affected versions: Debian 13 (trixie) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2002-1154 Upstream summary: anlgform.pl in Analog before 5.23 does not restrict access to the PROGRESSFREQ progress update command, which allows remote attackers to cause a denial of service […]
🟢 Low ⏱ 5–15 min Last verified: 8 June 2026 Affected versions: Debian 13 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2026-28684 Upstream summary: python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic […]
🟡 Medium ⏱ 10–30 min Last verified: 8 June 2026 Affected versions: Debian 11 (bullseye) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2008-0299 CVE-2018-1000805 CVE-2018-7750 CVE-2022-24302 CVE-2023-48795 CVE-2026-44405 Upstream summary: common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one […]
