What’s Vulnerable › Products
Debian Linux vulnerabilities
10011 known vulnerabilities, 124 confirmed exploited in the wild (CISA KEV), 259 published in the last 12 months.
Check whether your Debian Linux version is affected
Exploited Debian Linux vulnerabilities
- CVE-2015-5477 — ISC BIND Data Processing Errors Vulnerability
- CVE-2015-3306 — ProFTPD Improper Access Control Vulnerability
- CVE-2025-39682 — Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- CVE-2022-0492 — Linux Kernel Improper Authentication Vulnerability
- CVE-2026-31431 — Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
- CVE-2021-30952 — Apple Multiple Products Integer Overflow or Wraparound Vulnerability
- CVE-2025-49113 — RoundCube Webmail Deserialization of Untrusted Data Vulnerability
- CVE-2026-24061 — GNU InetUtils Argument Injection Vulnerability
- CVE-2025-41244 — Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
- CVE-2025-32463 — Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
- CVE-2021-21311 — Adminer Server-Side Request Forgery Vulnerability
- CVE-2025-38352 — Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability
- CVE-2025-48384 — Git Link Following Vulnerability
- CVE-2025-6558 — Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
- CVE-2019-5418 — Rails Ruby on Rails Path Traversal Vulnerability
- CVE-2023-0386 — Linux Kernel Improper Ownership Management Vulnerability
- CVE-2025-32433 — Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
- CVE-2025-27363 — FreeType Out-of-Bounds Write Vulnerability
- CVE-2024-53197 — Linux Kernel Out-of-Bounds Access Vulnerability
- CVE-2024-53150 — Linux Kernel Out-of-Bounds Read Vulnerability
- CVE-2025-24813 — Apache Tomcat Path Equivalence Vulnerability
- CVE-2025-24201 — Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
- CVE-2024-50302 — Linux Kernel Use of Uninitialized Resource Vulnerability
- CVE-2024-53104 — Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2020-11023 — JQuery Cross-Site Scripting (XSS) Vulnerability
Latest Debian Linux vulnerabilities
- CVE-2026-12996 — (CVSS 8.1)
- CVE-2026-14355 — ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD (CVSS 5.3)
- CVE-2026-56968 — (CVSS 5.3)
- CVE-2026-49975 — Apache HTTP Server: mod_http2 denial of service (CVSS 7.5)
- CVE-2026-9256 — NGINX ngx_http_rewrite_module vulnerability (CVSS 8.1)
- CVE-2026-46333 — ptrace: slightly saner 'get_dumpable()' logic (CVSS 7.1)
- CVE-2026-31431 — Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability (CVSS 7.8) — exploited
- CVE-2026-41082 — (CVSS 7.8)
- CVE-2026-34757 — LIBPNG has a yse-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST leading to corrupted chunk data and potential heap information disclosure (CVSS 4.4)
- CVE-2026-4775 — Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing (CVSS 7.8)
- CVE-2026-1940 — Gstreamer: incomplete fix of cve-2026-1940 (CVSS 7.5)
- CVE-2025-63261 — (CVSS 7.8)
- CVE-2026-3497 — (CVSS 7.5)
- CVE-2026-25506 — MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVSS 7.8)
- CVE-2025-64098 — FastDDS has Out-of-memory in readOctetVector via Manipulated DATA Submessage when DDS Security is enabled (CVSS 5.9)
- CVE-2025-62799 — FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE) (CVSS 9.8)
- CVE-2025-62603 — FastDDS has Out-of-memory while parsing GenericMessage when DDS Security is enabled (CVSS 7.5)
- CVE-2025-62602 — FastDDS has heap buffer overflow in readData via Manipulated DATA Submessage when DDS Security is enabled (CVSS 7.5)
- CVE-2025-62600 — eprosima Fast DDS affected by Out-of-Memory in readBinaryPropertySeq via Manipulated DATA Submessage when DDS Security is enabled (CVSS 7.5)
- CVE-2025-62599 — eprosima Fast DDS affected by Out-of-Memory in readPropertySeq via Manipulated DATA Submessage when DDS Security is enabled (CVSS 7.5)
- CVE-2026-25061 — tcpflow has TIM Element OOB Write in wifipcap (CVSS 7.5)
- CVE-2026-24765 — PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling (CVSS 7.8)
- CVE-2025-68670 — xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow (CVSS 9.8)
- CVE-2026-24061 — GNU InetUtils Argument Injection Vulnerability (CVSS 9.8) — exploited
- CVE-2026-23490 — pyasn1 has a DoS vulnerability in decoder (CVSS 7.5)