Debian vulnerabilities

Latest Debian CVEs

Newest publication first · page 27 of 40 · showing the latest 1,000

1. CVE-2026-102523 MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION

   Published 2026-11-05

   High·CVSS 8.0 EPSS 0.75%

   MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path constructi...

2. CVE-2026-107891 musl: musl: Arbitrary code execution via integer overflow in regcomp

   Published 2026-11-05

   High·CVSS 8.1 EPSS 0.55%

   musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.

3. CVE-2026-123095 mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines

   Published 2026-11-05

   High·CVSS 7.7 EPSS 0.49%

   mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:/...

4. CVE-2026-122330 Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()

   Published 2026-11-05

   Medium·CVSS 6.8 EPSS 0.24%

   Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious B...

5. CVE-2026-122329 SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder

   Published 2026-11-05

   High·CVSS 8.5 EPSS 0.16%

   SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory w...

6. CVE-2026-122328 SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder

   Published 2026-11-05

   High·CVSS 8.5 EPSS 0.16%

   SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memo...

7. CVE-2026-123119 Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)

   Published 2026-11-05

   Low·CVSS 2.3 EPSS 0.23%

   The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior...

8. CVE-2026-123036 ansible-core: no_log does not censor the task exception field, leaking secret values via the default stdout callback

   Published 2026-11-05

   Medium·CVSS 5.5 EPSS 0.15%

   A flaw was found in ansible-core. When a task marked no_log: true fails, the task result is censored before being emitted, but the exception field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback print...

9. CVE-2026-122052 laspy LAS File lasreader.py memory allocation

   Published 2026-11-05

   Medium·CVSS 5.3 EPSS 0.33%

   A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible.

10. CVE-2026-122299 Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation

    Published 2026-11-04

    High·CVSS 8.6 EPSS 0.33%

    Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses du...

11. CVE-2026-115473 Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)

    Published 2026-11-04

    Medium·CVSS 6.5 EPSS 0.26%

    Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http...

12. CVE-2026-55367 h2o: heap exhaustion using capsules

    Published 2026-11-04

    High·CVSS 7.5 EPSS 0.34%

    h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a pe...

13. CVE-2026-55368 h2o: buffer overflow when using the %{error}x log directive

    Published 2026-11-04

    High·CVSS 8.1 EPSS 0.32%

    h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %...

14. CVE-2026-122132 go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware

    Published 2026-11-04

    Medium·CVSS 5.1 EPSS 0.27%

    go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers stri...

15. CVE-2026-122130 CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin

    Published 2026-11-04

    High·CVSS 8.3 EPSS 0.32%

    CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large...

16. CVE-2026-122129 CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder

    Published 2026-11-04

    Medium·CVSS 6.9 EPSS 0.40%

    CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with ve...

17. CVE-2026-122127 CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder

    Published 2026-11-04

    High·CVSS 8.7 EPSS 0.39%

    CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled b...

18. CVE-2026-63183 OmniAuth: Host Header Injection Vulnerability

    Published 2026-11-04

    Medium·CVSS 6.9 EPSS 0.18%

    OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthentic...

19. CVE-2026-121971 Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References

    Published 2026-11-04

    High·CVSS 8.2 EPSS 0.25%

    The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as "//evil.example/steal" to be sent to an...

20. CVE-2026-122054 BIG-HKSCS decoding hang on crafted input

    Published 2026-11-04

    Medium·CVSS 5.9 EPSS 0.45%

    Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.

21. CVE-2026-106554 jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)

    Published 2026-11-04

    High·CVSS 7.5 EPSS 0.38%

    One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x...

22. CVE-2026-109518 APT RCE via hard link reuse

    Published 2026-11-04

    High·CVSS 7.7 EPSS 0.93%

    On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-contr...

23. CVE-2026-121964 FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment

    Published 2026-11-04

    High·CVSS 8.7 EPSS 0.57%

    FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the curren...

24. CVE-2026-121963 FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close

    Published 2026-11-04

    High·CVSS 8.2 EPSS 0.31%

    FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so t...

25. CVE-2026-121962 FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read

    Published 2026-11-04

    High·CVSS 7.2 EPSS 0.33%

    FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User Authorization reads during PROTOCOL_HYBRID_EX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer b...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.