# cve.now: Debian

The newest entries naming Debian as an affected vendor (up to 200), of 30 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123962](https://cve.now/CVE-2026-123962.md): In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized\_keys… (CVSS 8.4)
- [CVE-2026-109518](https://cve.now/CVE-2026-109518.md): APT RCE via hard link reuse (CVSS 7.7)
- [CVE-2026-89169](https://cve.now/CVE-2026-89169.md): live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. (CVSS 4.1)
- [CVE-2026-77118](https://cve.now/CVE-2026-77118.md): Out-of-bounds write in GraphicsMagick PCD decoder (CVSS 8.4)
- [CVE-2026-11853](https://cve.now/CVE-2026-11853.md): Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. (CVSS 6.5)
- [CVE-2026-11852](https://cve.now/CVE-2026-11852.md): Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. (CVSS 6.5)
- [CVE-2026-2219](https://cve.now/CVE-2026-2219.md): It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data s (CVSS 7.5)
- [CVE-2025-68462](https://cve.now/CVE-2025-68462.md): Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases. (CVSS 3.2)
- [CVE-2025-8454](https://cve.now/CVE-2025-8454.md): It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of sc (CVSS 9.8)
- [CVE-2025-6297](https://cve.now/CVE-2025-6297.md): dpkg-deb: Fix cleanup for control member with restricted directories (CVSS 8.2)
- [CVE-2025-53391](https://cve.now/CVE-2025-53391.md): The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt\_6.2.0-1 package has insecure PolicyKit allow\_any/allow\_inactiv (CVSS 9.3)
- [CVE-2014-7210](https://cve.now/CVE-2014-7210.md): pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. (CVSS 9.8)
- [CVE-2025-47153](https://cve.now/CVE-2025-47153.md): Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs\_20.19.0+dfsg-2\_i386.d (CVSS 6.5)
- [CVE-2024-2312](https://cve.now/CVE-2024-2312.md): GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after (CVSS 6.7)
- [CVE-2023-7207](https://cve.now/CVE-2023-7207.md): Debian's cpio contains a path traversal vulnerability. (CVSS 4.9)
- [CVE-2022-2787](https://cve.now/CVE-2022-2787.md): stricter rules on chroot names (no CVSS)
- [CVE-2022-1664](https://cve.now/CVE-2022-1664.md): directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar (no CVSS)
- [CVE-2016-1239](https://cve.now/CVE-2016-1239.md): duck before 0.10 did not properly handle loading of untrusted code from the current directory. (no CVSS)
- [CVE-2022-0543](https://cve.now/CVE-2022-0543.md): It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape (CVSS 10.0, KEV)
- [CVE-2021-20001](https://cve.now/CVE-2021-20001.md): It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure pe (no CVSS)
- [CVE-2020-3811](https://cve.now/CVE-2020-3811.md): qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability. (no CVSS)
- [CVE-2020-3812](https://cve.now/CVE-2020-3812.md): qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. (no CVSS)
- [CVE-2020-3810](https://cve.now/CVE-2020-3810.md): Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing special (no CVSS)
- [CVE-2012-1093](https://cve.now/CVE-2012-1093.md): The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a privilege escalation d (no CVSS)
- [CVE-2019-3467](https://cve.now/CVE-2019-3467.md): Debian-edu-config all versions \< 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config \< 0.26, configured too per (no CVSS)
- [CVE-2017-5332](https://cve.now/CVE-2017-5332.md): The extract\_group\_icon\_cursor\_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local use (no CVSS)
- [CVE-2017-5331](https://cve.now/CVE-2017-5331.md): Integer overflow in the check\_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of ser (no CVSS)
- [CVE-2017-5333](https://cve.now/CVE-2017-5333.md): Integer overflow in the extract\_group\_icon\_cursor\_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to (no CVSS)
- [CVE-2018-5735](https://cve.now/CVE-2018-5735.md): Backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858 (CVSS 7.5)
- [CVE-2017-0359](https://cve.now/CVE-2017-0359.md): diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/debian
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.