Debian

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 7.7HighNov 4, 2026Debian APTCVE-2026-109518On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package filExploit code
• 4.1MediumSep 11, 2026Debian live-boot Crypto / certificateCVE-2026-89169live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.
• 7.5HighMar 7, 2026Debian dpkg Denial of serviceCVE-2026-2219It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).
• 7.8HighSep 27, 2024debian linux Memory corruptionCVE-2024-46852In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps: Don't track CMA dma-buf pages under RssFile") it was possible to obtain a mapping larger than the buffer size via mremap and bypass the overflow check in dma_buf_mmap_internal. When using such a mapping to attempt to fault past the end of the buffer, the CMA heap fault handler also checks the fault of
• 5.5MediumFeb 11, 2024debian linux Memory corruptionCVE-2024-1151A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and causing a stack overflow. As a result, this can lead to a crash or other related issues.
• 7.5HighJan 25, 2024debian linux Memory corruptionCVE-2023-52356A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.2.2% likelyExploit code
• 6.6MediumJan 18, 2024debian linuxCVE-2024-0607A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality
• 6.2MediumJan 15, 2024debian linux Memory corruptionCVE-2023-6915A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.
• 7.0HighJan 4, 2024debian linux Memory corruptionCVE-2023-6270A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution.
• 5.9MediumNov 28, 2023debian linuxCVE-2023-5981A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.1.3% likely
• 7.8HighSep 27, 2023debian linux Memory corruptionCVE-2023-5197A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.
• 5.9MediumDec 5, 2017Debian advanced package tool Crypto / certificateCVE-2016-1252The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mecha7.2% likelyExploit-DB
• 6.8MediumSep 30, 2014Debian advanced package tool Memory corruptionCVE-2014-6273Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.2.4% likely

See every Debian entry on the dashboard.

Top products

• live-boot1 CVE in the last year
• dpkg1 CVE in the last year
• APT1 CVE in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• AWS · Nov 6, 2026CVE-2026-109518 - APT package manager that affects Ubuntu and Debian operating systemsCVE-2026-109518
• oss-security · Nov 4, 2026CVE-2026-109518: RCE in apt(1) (DSA 6607-1)CVE-2026-109518