Lucene search
+L
DebiancveRecent

63340 matches found

Debian CVE
Debian CVE
•added 2026/06/23 4:18 p.m.•9 views

CVE-2026-56968

GNU SASL before 2.2.4 lacks sanitization of a short challenge in gsaslntlmclientstep in the NTLM client, which could result in memory disclosure via a crafted server...

5.3CVSS5.8AI score0.00286EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2026/06/23 4:14 p.m.•12 views

CVE-2026-56117

dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket...

5.7CVSS5.9AI score0.00093EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 4:13 p.m.•11 views

CVE-2026-50019

yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. At the file downloa...

7.4CVSS5.8AI score0.00268EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 4:11 p.m.•11 views

CVE-2026-56116

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send...

7.1CVSS5.8AI score0.00188EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 4:9 p.m.•10 views

CVE-2026-50574

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format such as an HLS/DASH stream, yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On...

9.6CVSS6.5AI score0.00406EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 4:8 p.m.•12 views

CVE-2026-56115

Removed by vendor...

8.8CVSS5.8AI score0.00343EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2026/06/23 4:8 p.m.•12 views

CVE-2026-50023

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files such as .desktop, .url, .webloc to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitl...

9.6CVSS6AI score0.0062EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2026/06/23 4:8 p.m.•10 views

CVE-2026-56114

dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6makemessage in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTIONPDEXCLUDE option body...

6.5CVSS6.1AI score0.00175EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 4:5 p.m.•19 views

CVE-2026-56113

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTIONPDEXCLUDE and both preferred and valid lifetimes set to zero. Attackers actin...

6.5CVSS5.9AI score0.00175EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 4:4 p.m.•10 views

CVE-2026-11940

tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower...

7.8CVSS5.8AI score0.0075EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 3:7 p.m.•42 views

CVE-2026-55766

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled dat...

4.8CVSS5.8AI score0.00158EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 3:5 p.m.•18 views

CVE-2026-55767

Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::valida...

5.8CVSS5.9AI score0.00143EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 2:54 p.m.•9 views

CVE-2026-55568

Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmitted in cleartext. Proxy authentication credentials the Proxy-Authorization header, proxy userinfo in the proxy URL, or CURLOPTPROXYUSERPW...

5.9CVSS5.9AI score0.00106EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 1:28 p.m.•14 views

CVE-2026-12969

An out-of-bounds read vulnerability exists in dnsmasq's findsoa function in src/rfc1035.c. When parsing NS section records, extractname is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can...

5.3CVSS6AI score0.00239EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:13 p.m.•11 views

CVE-2026-56379

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering...

9.2CVSS6.1AI score0.00884EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:13 p.m.•10 views

CVE-2026-56376

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service...

6.3CVSS5.9AI score0.00184EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:13 p.m.•11 views

CVE-2026-56371

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is process...

6.9CVSS5.8AI score0.00257EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 3:37 a.m.•13 views

CVE-2026-55654

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI Generic Security Service Application Programming Interface indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific...

3.7CVSS5.8AI score0.00396EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2026/06/23 3:36 a.m.•15 views

CVE-2026-55655

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

6.1CVSS5.7AI score0.00089EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 3:36 a.m.•12 views

CVE-2026-55653

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange DH-GEX client path. This occurs during FIPS Federal Information Processing Standards mode known-group validation when the client processes attacker-controlled DH-GEX...

6.5CVSS5.8AI score0.00283EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•8 views

CVE-2025-55639

GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gfisomaddtrackkind function at isomedia/isomwrite.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

6.5CVSS5.9AI score0.00383EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•9 views

CVE-2025-61023

An issue in the stcompare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

7.5CVSS5.8AI score0.00476EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•10 views

CVE-2025-61022

An issue in the sqlotbcolpreds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

7.5CVSS5.8AI score0.00351EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•9 views

CVE-2025-61025

An issue in the sslrqstget component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

7.5CVSS5.8AI score0.00351EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•8 views

CVE-2025-61018

An issue in the sqloplacedtset component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

7.5CVSS5.8AI score0.00476EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•6 views

CVE-2026-8343

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•7 views

CVE-2025-61021

An issue in the sqlonaturaljoincond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

7.5CVSS5.8AI score0.00351EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•8 views

CVE-2026-48003

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•7 views

CVE-2026-48002

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•9 views

CVE-2025-61019

An issue in the sqlokeypartbest component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

7.5CVSS5.8AI score0.00351EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•8 views

CVE-2025-61020

An issue in the sqlostripinjoin component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

7.5CVSS5.8AI score0.00476EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•9 views

CVE-2025-61024

An issue in the sqlotryinloop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

7.5CVSS5.8AI score0.00351EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•9 views

CVE-2025-61029

An issue in the sqlountry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

7.5CVSS5.8AI score0.00351EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•11 views

CVE-2025-61027

An issue in the tsetpush component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

7.5CVSS5.8AI score0.00351EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/23 12:0 a.m.•10 views

CVE-2025-61028

An issue in the timettodt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

7.5CVSS5.8AI score0.00476EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 9:30 p.m.•10 views

CVE-2026-44889

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit stri...

6.1CVSS5.9AI score0.00162EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 8:53 p.m.•19 views

CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

6.5CVSS5.8AI score0.00272EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 8:35 p.m.•11 views

CVE-2026-41479

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

5.4CVSS6AI score0.00183EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2026/06/22 8:28 p.m.•11 views

CVE-2026-54651

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1...

6.9CVSS5.8AI score0.0011EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 8:28 p.m.•10 views

CVE-2026-49460

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2...

5.1CVSS5.8AI score0.00117EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 8:27 p.m.•13 views

CVE-2026-49461

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12....

6.9CVSS5.8AI score0.00121EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 8:26 p.m.•11 views

CVE-2026-54531

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0...

6.9CVSS5.8AI score0.00121EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 8:25 p.m.•13 views

CVE-2026-54530

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0...

6.9CVSS5.8AI score0.00121EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 8:19 p.m.•9 views

CVE-2026-47242

Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAPid is called with a hash argument, although the ID field value strings are correctly quoted escaping quoted specials, they were not validated to prohibit CRLF sequence...

5.8CVSS5.9AI score0.00131EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 8:17 p.m.•10 views

CVE-2026-47240

Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing...

5.8CVSS5.9AI score0.00491EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 8:11 p.m.•9 views

CVE-2026-47241

Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled inpu...

2.1CVSS5.8AI score0.00239EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 8:0 p.m.•10 views

CVE-2026-55599

phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate with phpseclib, X509::validateSignature reads a URL out of that certificate's Authority Information Access AIA extension and connects to it...

5.8CVSS5.9AI score0.00156EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2026/06/22 7:56 p.m.•13 views

CVE-2026-44727

Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyterserver render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default...

9.3CVSS5.9AI score0.00305EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/06/22 6:59 p.m.•18 views

CVE-2026-48931

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

3.7CVSS5.8AI score0.00345EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2026/06/22 5:25 p.m.•12 views

CVE-2026-54293

NLTK Natural Language Toolkit is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments...

7.5CVSS6AI score0.00555EPSS
SaveExploits1
Total number of security vulnerabilities63340