en
Debian is an international free-software project and community that produces and maintains the Debian operating system, primarily Debian GNU/Linux, together with a large collection of packaged applications and system tools. It supports general users, developers, administrators, and organizations through community-led development and maintenance.
As of 11/13/2026, Debian recorded 4 security vulnerabilities in the last 90 days across 4 products, including 3 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, APT had the most security vulnerabilities in the Debian ecosystem, with 1 vulnerabilities—approximately 25% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-91094CVE-2026-91094CVE-2026-123962Debian FreedomBox symlink flaw enables unauthorized file read and writeCVE-2026-109518Hard-link package replacement in Debian and Ubuntu APT enables root code executionCVE-2026-89169Debian live-boot dm-verity signature enforcement bypass when.verity is missingCVE-2026-77118GraphicsMagick Group GraphicsMagick PCD decoder heap out-of-bounds write| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-91094CVE-2026-91094 | Exploitation statusNot confirmed | FixYes | Affected product |
| Published11/13/2026 |
| SeverityUnknown |
CVE-2026-123962Debian FreedomBox symlink flaw enables unauthorized file read and write | Exploitation statusNot exploited | FixYes | Affected productFreedomBox | Published11/06/2026 | SeverityHigh |
|---|
CVE-2026-109518Hard-link package replacement in Debian and Ubuntu APT enables root code execution | Exploitation statusNot confirmed | FixYes | Affected productAPT | Published11/04/2026 | SeverityHigh |
|---|
CVE-2026-89169Debian live-boot dm-verity signature enforcement bypass when.verity is missing | Exploitation statusNot confirmed | FixNo | Affected productlive-boot | Published09/11/2026 | SeverityMedium |
|---|
CVE-2026-77118GraphicsMagick Group GraphicsMagick PCD decoder heap out-of-bounds write | Exploitation statusNot exploited | FixYes | Affected productgraphicsmagick | Published08/20/2026 | SeverityHigh |
|---|
CVE-2026-11853CVE-2026-11853 | Exploitation statusNot exploited | FixYes | Affected productdebusine | Published06/10/2026 | SeverityMedium |
|---|
CVE-2026-11852CVE-2026-11852 | Exploitation statusNot exploited | FixYes | Affected productdebusine | Published06/10/2026 | SeverityMedium |
|---|
CVE-2026-2219CVE-2026-2219 | Exploitation statusNot exploited | FixYes | Affected productdpkg | Published03/07/2026 | SeverityHigh |
|---|
CVE-2025-68462CVE-2025-68462 | Exploitation statusNot exploited | FixYes | Affected productFreedomBox | Published12/18/2025 | SeverityLow |
|---|
CVE-2025-6297dpkg-deb: Fix cleanup for control member with restricted directories | Exploitation statusNot exploited | FixYes | Affected productdpkg | Published07/01/2025 | SeverityHigh |
|---|
CVE-2024-2312CVE-2024-2312 | Exploitation statusNot exploited | FixYes | Affected productDebian based GNU GRUB | Published04/05/2024 | SeverityMedium |
|---|
CVE-2024-30203GNU Emacs, Gnus, and Org mode trust inline MIME content, enabling unsafe processing | Exploitation statusNot exploited | FixYes | Affected productdebian_linux | Published03/25/2024 | SeverityMedium |
|---|
CVE-2023-7207CVE-2023-7207 | Exploitation statusNot exploited | FixYes | Affected productDebian cpio | Published01/05/2024 | SeverityMedium |
|---|
CVE-2022-37454CVE-2022-37454 | Exploitation statusActively exploited | FixYes | Affected productdebian_linux | Published10/21/2022 | SeverityCritical |
|---|
CVE-2022-1664directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar | Exploitation statusNot confirmed | FixYes | Affected productdpkg | Published05/26/2022 | SeverityUnknown |
|---|
CVE-2022-0543CVE-2022-0543 | Exploitation statusKEV | FixNo | Affected productredis | Published02/18/2022 | SeverityCritical |
|---|
CVE-2017-5333CVE-2017-5333 | Exploitation statusNot confirmed | FixNo | Affected producticoutils | Published11/04/2019 | SeverityUnknown |
|---|
CVE-2017-5332CVE-2017-5332 | Exploitation statusNot confirmed | FixNo | Affected producticoutils | Published11/04/2019 | SeverityUnknown |
|---|
CVE-2017-5331CVE-2017-5331 | Exploitation statusNot confirmed | FixNo | Affected producticoutils | Published11/04/2019 | SeverityUnknown |
|---|
CVE-2019-14287CVE-2019-14287 | Exploitation statusActively exploited | FixYes | Affected productUbuntu Linux | Published10/17/2019 | SeverityHigh |
|---|
CVE-2019-11358CVE-2019-11358 | Exploitation statusActively exploited | FixYes | Affected productbackdrop | Published04/19/2019 | SeverityMedium |
|---|
CVE-2019-9942Symfony Twig sandbox policy bypass enables information disclosure | Exploitation statusNot confirmed | FixYes | Affected productdebian_linux | Published03/23/2019 | SeverityLow |
|---|
CVE-2015-3306CVE-2015-3306 | Exploitation statusKEV | FixNo | Affected productdebian_linux | Published05/18/2015 | SeverityCritical |
|---|
CVE-2014-3704CVE-2014-3704 | Exploitation statusActively exploited | FixYes | Affected productdebian_linux | Published10/16/2014 | SeverityHigh |
|---|
CVE-2014-7169Incomplete function parsing in GNU Bash enables crafted-environment file writes | Exploitation statusKEV | FixYes | Affected producteos | Published09/25/2014 | SeverityCritical |
|---|
CVE-2014-6271Environment-variable command injection enables arbitrary code execution in GNU Bash | Exploitation statusKEV | FixYes | Affected producteos | Published09/24/2014 | SeverityCritical |
|---|
25 Results | Page 1 of 1