Lucene search
+L
DebiancveRecent

61322 matches found

Debian CVE
Debian CVE
added 2026/05/12 12:0 a.m.18 views

CVE-2026-31236

The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec function...

9.8CVSS6.3AI score0.00327EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/12 12:0 a.m.65 views

CVE-2026-45185

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS closenotify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to...

9.8CVSS6.2AI score0.01225EPSS
Exploits2
Debian CVE
Debian CVE
added 2026/05/11 9:23 p.m.10 views

CVE-2026-42046

libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write heap overflow by supplying a crafted file in the "caca" format. Depending on the build...

7.8CVSS6.2AI score0.00223EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 9:14 p.m.10 views

CVE-2026-7010

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the Host: header, and HTTP/1.1 control data field values. An attacker who controls one ...

6.5CVSS5.8AI score0.00227EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 7:46 p.m.7 views

CVE-2026-42050

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-21 and 6.9.13-46, a malicious MIFF file could trigger an overflow when a user opens it in the display tool and right-clicks a tile to invoke the Load / Update menu item. This vulnerabilit...

5.5CVSS5.9AI score0.0013EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 6:6 p.m.9 views

CVE-2026-43968

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cowsse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefixlines/2 function...

6.3CVSS6AI score0.00266EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 6:6 p.m.24 views

CVE-2026-7790

Uncontrolled Resource Consumption vulnerability in ninenines cowlib cowhttpte module allows Excessive Allocation. The chunked transfer-encoding parser in cowhttpte accepts an unbounded number of hex digits in the chunk-size field. Each digit causes a bignum multiplication Len 16 + digit, so parsi...

8.7CVSS5.9AI score0.00431EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 6:6 p.m.13 views

CVE-2026-43969

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields. cowcookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs...

3.2CVSS6AI score0.00145EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 5:36 p.m.13 views

CVE-2026-42859

Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overflow exists in neatvnc in the RSA-AES security type handler. An unauthenticated remote attacker who can reach the VNC listening socket can send a crafted security type 5 RSA-AES or security type 129 RSA-AES-25...

9.3CVSS6AI score0.0055EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 5:24 p.m.14 views

CVE-2026-43896

jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jvobjectmergerecursive allows a crafted jq program to crash the process with a segfault. The function is reachable through the operator when both operands are objects...

6.2CVSS5.8AI score0.00154EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/11 5:24 p.m.9 views

CVE-2026-43895

jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy o...

4.4CVSS5.9AI score0.00157EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/11 5:23 p.m.9 views

CVE-2026-44777

jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other...

6.8CVSS5.8AI score0.00161EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/11 5:20 p.m.7 views

CVE-2026-43894

jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INTMAX-1 2147483646 digits, the D2U macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-by...

6.2CVSS5.8AI score0.00158EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/11 5:19 p.m.14 views

CVE-2026-7210

xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch...

7.5CVSS5.8AI score0.0079EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 5:18 p.m.21 views

CVE-2026-41256

jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before...

5.5CVSS5.9AI score0.00158EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/11 5:16 p.m.35 views

CVE-2026-40612

jq is a command-line JSON processor. In 1.8.1 and earlier, jvcontains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure built programmatically with reduce, since the JSON parser caps at depth 10000, the C stack is exhausted...

6.8CVSS5.8AI score0.00161EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/11 5:14 p.m.10 views

CVE-2026-41257

jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB via deeply nested generator forks, the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for ...

7.3CVSS5.8AI score0.00142EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/11 4:55 p.m.65 views

CVE-2026-5266

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from before 1.43.7, 1.44.4, 1.45.2...

2.3CVSS5.8AI score0.00247EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 4:53 p.m.6 views

CVE-2026-34095

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from before 1.43.7, 1.44.4, 1.45.2...

6.1CVSS5.8AI score0.00199EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 4:50 p.m.6 views

CVE-2026-34094

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from before 1.43.7, 1.44.4, 1.45.2...

3.8CVSS5.8AI score0.0017EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 4:48 p.m.16 views

CVE-2026-5172

A buffer overflow in dnsmasq’s extractaddresses function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extractname to advance the pointer past the record’s end...

7.5CVSS6AI score0.02683EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/11 4:48 p.m.19 views

CVE-2026-34093

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from before 1.43.7, 1.44.4, 1.45.2...

5.3CVSS5.8AI score0.00227EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 4:48 p.m.7 views

CVE-2026-4893

An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information...

5.3CVSS5.8AI score0.02681EPSS
Exploits2
Debian CVE
Debian CVE
added 2026/05/11 4:47 p.m.8 views

CVE-2026-4892

A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet...

8.8CVSS6.2AI score0.00812EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/11 4:47 p.m.21 views

CVE-2026-4891

A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet...

7.5CVSS5.8AI score0.06226EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 4:47 p.m.10 views

CVE-2026-4890

A Denial of Service DoS vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet...

7.5CVSS5.8AI score0.07237EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 4:47 p.m.14 views

CVE-2026-2291

dnsmasqs extractname function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS...

7.3CVSS5.9AI score0.00771EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/11 3:0 p.m.11 views

CVE-2026-34092

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from before 1.43.7, 1.44.4, 1.45.2...

7.5CVSS5.8AI score0.00237EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 2:55 p.m.19 views

CVE-2026-34091

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from before 1.43.7, 1.44.4, 1.45.2...

7.5CVSS5.8AI score0.0029EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 2:50 p.m.22 views

CVE-2026-34090

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1.45.2...

7.5CVSS5.8AI score0.0028EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 2:46 p.m.7 views

CVE-2026-34089

Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2...

2.3CVSS5.8AI score0.00228EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 2:43 p.m.5 views

CVE-2026-34088

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from before 1.43.7, 1.44.4, 1.45.2...

7.5CVSS5.8AI score0.0029EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 2:40 p.m.14 views

CVE-2026-34087

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from before 1.43.7, 1.44.4, 1.45.2...

7.5CVSS5.8AI score0.00267EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 2:35 p.m.19 views

CVE-2026-34086

Vulnerability in Wikimedia Foundation AbuseFilter. This issue affects AbuseFilter: from before 1.43.7, 1.44.4, 1.45.2...

2.1CVSS5.8AI score0.00244EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 12:48 p.m.9 views

CVE-2026-4802

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface UI. An attacker can inject shell metacharacters and command...

8CVSS7.3AI score0.01016EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 6:26 a.m.22 views

CVE-2026-43500

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpcinputcallevent and the RESPONSE handler in rxrpcverifyresponse copy the skb to a linear one before calling into the security o...

7.8CVSS6AI score0.92766EPSS
Exploits21
Debian CVE
Debian CVE
added 2026/05/11 5:15 a.m.10 views

CVE-2026-8276

A flaw has been found in bettercap up to 2.41.5. Affected by this issue is some unknown functionality of the file modules/mysqlserver/mysqlserver.go of the component MySQL Server. Executing a manipulation can lead to integer coercion error. The attack can be launched remotely. The attack requires...

6.3CVSS5AI score0.00389EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 5:0 a.m.43 views

CVE-2026-8275

A vulnerability was detected in bettercap up to 2.41.5. Affected by this vulnerability is the function ippReadChunkedBody of the file modules/zerogod/zerogodippprimitives.go of the component zerogod IPP Service. Performing a manipulation results in integer coercion error. The attack can be...

6.3CVSS5.1AI score0.00523EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 1:30 a.m.10 views

CVE-2026-8261

A vulnerability was determined in Squirrel up to 3.2. This affects the function SQFunctionProto::Load of the file squirrel/sqobject.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. T...

5.9CVSS6.3AI score0.00154EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 12:45 a.m.9 views

CVE-2026-8258

A flaw has been found in Squirrel up to 3.2. Impacted is the function validateformat in the library sqstdlib/sqstdstring.cpp. Executing a manipulation can lead to stack-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used. The project was...

5.3CVSS6.2AI score0.00123EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/11 12:30 a.m.8 views

CVE-2026-8257

A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function IRBuilder::makeBrOn of the file src/wasm/wasm-ir-builder.cpp of the component BrOn Parser. Performing a manipulation results in reachable assertion. The attack needs to be approached locally. The explo...

5.5CVSS5.3AI score0.00159EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/11 12:0 a.m.8 views

CVE-2026-37630

An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the jsmappedargumentsmark function...

7.3CVSS6.2AI score0.00233EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/10 8:48 p.m.13 views

CVE-2026-8177

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory...

7.5CVSS5.8AI score0.00629EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/10 8:15 p.m.10 views

CVE-2026-45191

Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass. Mask forms like "/00" and "/01" pass validation and parse to the same prefix as their unpadded value. See also CVE-2026-45190...

6.5CVSS5.8AI score0.003EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/10 8:15 p.m.12 views

CVE-2026-45190

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the inp...

6.5CVSS5.8AI score0.00311EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/10 6:36 a.m.11 views

CVE-2026-45186

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input...

7.5CVSS5.7AI score0.00428EPSS
Exploits1
Debian CVE
Debian CVE
added 2026/05/10 4:43 a.m.19 views

CVE-2026-7263

In PHP versions 8.4. before 8.4.21 and 8.5. before 8.5.6, DOMNode::C14N method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial ...

7.5CVSS5.8AI score0.00353EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/10 4:35 a.m.11 views

CVE-2026-6104

In PHP versions 8.4. before 8.4.21 and 8.5. before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mbconvertencoding or related mbstring functions, the code incorrectly assumes that when strncasecmp returns 0 it means the strings have the same length. This can lead to...

9.1CVSS5.9AI score0.00469EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/10 4:28 a.m.35 views

CVE-2026-7258

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, some functions, including urldecode, pass signed char to ctype functions like isxdigit. On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can...

7.5CVSS5.8AI score0.00337EPSS
Exploits0
Debian CVE
Debian CVE
added 2026/05/10 4:19 a.m.40 views

CVE-2026-6722

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys,...

9.8CVSS6.1AI score0.00739EPSS
Exploits0
Total number of security vulnerabilities61322