DEBIAN-CVE-2026-76060

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

DEBIAN-CVE-2026-50152

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only mon allow r capabilities to...

DEBIAN-CVE-2026-54330

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

DEBIAN-CVE-2026-38347

A heap overflow in the ffswsalphablendaway function libswscale/alphablend.c of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service DoS via a crafted input...

DEBIAN-CVE-2026-38345

A Division-by-Zero vulnerability in the ffswsinitsinglecontext function /libswscale/utils.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via a crafted input...

DEBIAN-CVE-2026-38350

An integer overflow in the targetswsfuzzer function libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted input...

DEBIAN-CVE-2026-38349

An integer overflow in the hScale16To19c function libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted image file...

DEBIAN-CVE-2026-38348

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted image file...

DEBIAN-CVE-2026-38346

An integer overflow in the yuv2planeX8c function libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...

DEBIAN-CVE-2026-39944

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

DEBIAN-CVE-2026-38344

A NULL pointer dereference in the getminbuffersize function /libswscale/slice.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...

DEBIAN-CVE-2026-38343

An integer overflow in the libavfilter/vfscale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...

DEBIAN-CVE-2025-30156

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...

DEBIAN-CVE-2026-81893

A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write,...

DEBIAN-CVE-2026-81934

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server...

DEBIAN-CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

DEBIAN-CVE-2026-81524

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have...

DEBIAN-CVE-2026-81525

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...

DEBIAN-CVE-2026-81521

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...

DEBIAN-CVE-2026-81522

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...

DEBIAN-CVE-2026-59314

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

DEBIAN-CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

DEBIAN-CVE-2026-59281

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

DEBIAN-CVE-2026-59283

Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring...

DEBIAN-CVE-2026-59282

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

DEBIAN-CVE-2026-18374

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in...

DEBIAN-CVE-2026-81724

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed...

DEBIAN-CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

DEBIAN-CVE-2026-81727

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incrdownload methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader...

DEBIAN-CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

DEBIAN-CVE-2026-81723

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView.readxmlfragment that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected...

DEBIAN-CVE-2026-81722

nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...

DEBIAN-CVE-2026-78002

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory...

DEBIAN-CVE-2026-5680

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer method using exponential doubling,...

DEBIAN-CVE-2026-59280

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...

DEBIAN-CVE-2026-47891

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3....

DEBIAN-CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

DEBIAN-CVE-2026-47893

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

DEBIAN-CVE-2026-47887

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

DEBIAN-CVE-2026-47886

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

DEBIAN-CVE-2026-47888

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE...

DEBIAN-CVE-2026-47884

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

DEBIAN-CVE-2026-80183

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with includesubtree to the GET /v3/roleassignments endpoint. The domain's project record has...

DEBIAN-CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

DEBIAN-CVE-2026-79921

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial ...

DEBIAN-CVE-2026-77652

A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren-pPal = gnew0WPGColorRGB, 256; When handling a WPGCOLORMAP record, the parser reads a start index i16 and...

DEBIAN-CVE-2025-70290

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or...

DEBIAN-CVE-2025-70293

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fsgetbgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy which could lead to arbitrary code execution, a denial of service,...

DEBIAN-CVE-2026-75466

libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12 or tj3LoadImage16 using the default pixel format, the application may trigger a division-by-zero in allocsarray,...

DEBIAN-CVE-2026-48548

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently...