Debian vulnerabilities

Latest Debian CVEs

Newest publication first · page 18 of 40 · showing the latest 1,000

1. CVE-2026-125405 Ettercap through 0.8.4.1 Out-of-Bounds Read via HTTP NTLM Authentication Parsing

   Published 2026-11-09

   High·CVSS 7.2 EPSS 0.29%

   Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory...

2. CVE-2026-125404 Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption

   Published 2026-11-09

   High·CVSS 7.7 EPSS 0.13%

   Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buff...

3. CVE-2026-125403 Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts

   Published 2026-11-09

   High·CVSS 7.2 EPSS 0.23%

   Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response...

4. CVE-2026-125402 Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI Parsing

   Published 2026-11-09

   High·CVSS 7.2 EPSS 0.25%

   Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up t...

5. CVE-2026-125401 Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu Dissector

   Published 2026-11-09

   High·CVSS 7.2 EPSS 0.39%

   Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored...

6. CVE-2026-125400 Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution

   Published 2026-11-09

   High·CVSS 8.7 EPSS 0.25%

   Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potential...

7. CVE-2026-125396 Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery

   Published 2026-11-09

   High·CVSS 8.5 EPSS 0.13%

   Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, re...

8. CVE-2026-125394 FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache Pointer

   Published 2026-11-09

   Medium·CVSS 5.3 EPSS 0.21%

   FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to...

9. CVE-2026-125371 Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match

   Published 2026-11-09

   Medium·CVSS 6.3 EPSS 0.28%

   Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net,...

10. CVE-2026-125357 Munin munin-httpd through 2.999.18 Path Traversal via Static File Handler

    Published 2026-11-09

    Medium·CVSS 6.9 EPSS 0.74%

    Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../<file> to bypass...

11. CVE-2026-125111 Rack: Multipart parsing allows DoS via unbounded scan buffer growth

    Published 2026-11-09

    High·CVSS 7.5 EPSS 0.37%

    Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small part...

12. CVE-2026-125110 Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

    Published 2026-11-09

    Medium·CVSS 5.3 EPSS 0.25%

    Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info normalization but evaluates header_rules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through r...

13. CVE-2026-125109 Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835

    Published 2026-11-09

    Medium·CVSS 4.8 EPSS 0.22%

    Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host...

14. CVE-2026-125108 Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass

    Published 2026-11-09

    Low·CVSS 3.7 EPSS 0.24%

    Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body w...

15. CVE-2026-77473 AsyncSSH: SFTP Recursive Copy Path Traversal via Unsanitized Server-Supplied Filenames

    Published 2026-11-09

    Medium·CVSS 6.5 EPSS 0.54%

    AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient._copy() in asyncssh/sftp.py, reached through get(), mget...

16. CVE-2026-61812 ModSecurity: HTML decoder missing entities, leading to evasion

    Published 2026-11-09

    Medium·CVSS 6.3 EPSS 0.32%

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different by...

17. CVE-2026-73857 ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerability

    Published 2026-11-09

    High·CVSS 7.5 EPSS 0.40%

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsing_ctx_arg uninitialized in the SAX end-ele...

18. CVE-2026-104259 ModSecurity: removeComments Transformation Fails to Strip Adjacent Comments, Enabling WAF Rule Bypass

    Published 2026-11-09

    Medium·CVSS 5.4 EPSS 0.22%

    ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msre_fn_removeComments_execute in apache2/re_tfns.c and inplace() in src/actions/transformations/remove_comments.cc implement t:removeComment...

19. CVE-2026-123817 AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads

    Published 2026-11-09

    High·CVSS 8.7 EPSS 0.33%

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object ove...

20. CVE-2026-122056 Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service

    Published 2026-11-09

    Medium·CVSS 5.9 EPSS 0.32%

    A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting...

21. CVE-2026-123806 python-tuf: Platform-dependent delegation path matching

    Published 2026-11-09

    Medium·CVSS 4.0 EPSS 0.13%

    python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensit...

22. CVE-2026-125209 FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow via dvdsubenc.c

    Published 2026-11-09

    High·CVSS 8.5 EPSS 0.14%

    FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that underestimates RLE output size for odd-width rectangles. Attackers can supply files with crafted bitmap subtitles that, when transcoded to the dvdsub encoder, w...

23. CVE-2026-125208 FFmpeg through 9.0.2 V4L2 M2M Encoder Out-of-Bounds Write in v4l2_buffers.c

    Published 2026-11-09

    High·CVSS 7.3 EPSS 0.13%

    FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c because cumulative plane offsets are not checked against the V4L2 buffer length. Attackers can supply crafted video whose dimensions or padding cause un...

24. CVE-2026-125207 FFmpeg through 9.0.2 Excessive Memory Allocation via Interplay ACM Decoder

    Published 2026-11-09

    Medium·CVSS 6.8 EPSS 0.17%

    FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulnerability in the Interplay ACM decoder that allows attackers to exhaust memory via an attacker-controlled block size. Attackers can supply a crafted ACM file with maximum level and row count in extradata, making...

25. CVE-2026-125206 FFmpeg through 9.0.2 Out-of-Bounds Read via prores_ks Interlaced Alpha Encoding

    Published 2026-11-09

    Low·CVSS 2.0 EPSS 0.12%

    FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the prores_ks encoder's get_alpha_data() that reads before the blocks buffer for interlaced frames with odd heights. Attackers can supply video with alpha and odd height encoded to interlaced ProRes 4444, causin...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.