DEBIAN-CVE-2026-80712

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...

DEBIAN-CVE-2026-80683

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...

DEBIAN-CVE-2026-77341

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP respons...

DEBIAN-CVE-2026-81934

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server...

DEBIAN-CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

DEBIAN-CVE-2026-78323

A flaw was found in JSS Java Security Services. The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTEDCA flags to be accepted as trust anchors for TLS connections. In non-default configurations...

DEBIAN-CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

DEBIAN-CVE-2026-77220

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can...

DEBIAN-CVE-2026-62313

Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be trivially bypassed, allowing a user to create a non-isolated shared host idmap container in a project that is configured to forbid them. Th...

DEBIAN-CVE-2026-53583

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verifyservercert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GENIPADD...

DEBIAN-CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...

DEBIAN-CVE-2026-73253

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

DEBIAN-CVE-2026-63385

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...

DEBIAN-CVE-2026-55564

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyphcacheget function in libfreerdp/cache/glyph.c checks whether index is greater than cache-number instead of greater than or equal to it. A malicious RDP server can use GLYPHFRAGMENTUSE replay in...

DEBIAN-CVE-2026-54552

sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with uid set to an unprivileged user, the child changes its UID but can retain the paren...

DEBIAN-CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

DEBIAN-CVE-2026-23930

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

DEBIAN-CVE-2026-61666

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

DEBIAN-CVE-2026-72887

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...

DEBIAN-CVE-2026-72064

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

DEBIAN-CVE-2026-68473

In the Linux kernel, the following vulnerability has been resolved: powerpc/uaccess: correct check for CONFIGPPCE500 in maskuseraddress maskuseraddress incorrectly checks for CONFIGE500 instead of CONFIGPPCE500, causing maskuseraddressisel to not be used on E500 hardware. Fix the check to use the...

DEBIAN-CVE-2026-68465

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhcchangepinstate to allow default state restore esdhcchangepinstate checks for pins100mhz and pins200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents the...

DEBIAN-CVE-2026-47191

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

DEBIAN-CVE-2026-73480

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

DEBIAN-CVE-2026-73624

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen fil...

DEBIAN-CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

DEBIAN-CVE-2026-63294

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can...

DEBIAN-CVE-2026-63295

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges such as enforcing restricted.containers.privilege=isolated, LXD fails to enforce the...

DEBIAN-CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

DEBIAN-CVE-2026-68425

In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, aft...

DEBIAN-CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

DEBIAN-CVE-2026-65819

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

DEBIAN-CVE-2026-71478

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...

DEBIAN-CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

DEBIAN-CVE-2026-19146

Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-19147

Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-19028

H5Zfilterfletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a sizet underflow. This allows attackers to cause a denial ...

DEBIAN-CVE-2026-19024

NULL pointer dereference in H5Pgetfillvalue in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and...

DEBIAN-CVE-2026-69248

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com,...

DEBIAN-CVE-2026-59651

In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

DEBIAN-CVE-2026-59643

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

DEBIAN-CVE-2026-68579

FreeRDP before 3.30.0 = 3.29.0 contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStreamRead function client/Windows/wfcliprdr.c. When an OLE paste consumer e.g. explorer.exe calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStreamRead requests file...

DEBIAN-CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

DEBIAN-CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

DEBIAN-CVE-2026-17972

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-17964

Incorrect security UI in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-17949

Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-17940

Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-17912

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-17758

Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...