Debian vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20194
3. 20203
4. 20201
5. 20223
6. 20221
7. 20221
8. 20241
9. 20241
10. 20255
11. 20251
12. 20265

Known exploitedNewest addition to KEV first

• CVE-2022-0543

  It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could…

  Debian · redis

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-89169

  live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.

  Debian · live-boot

  Medium4.1
• CVE-2026-77118

  Out-of-bounds write in GraphicsMagick PCD decoder

  GraphicsMagick Group · GraphicsMagick

  High8.4
• CVE-2026-11853

  Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages (.dsc) and upload artifacts (.changes)…

  Debian · debusine

  Medium6.5
• CVE-2026-11852

  Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debusine are organized into artifacts. The…

  Debian · debusine

  Medium6.5
• CVE-2026-2219

  It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when…

  Debian · dpkg

  High7.5
• CVE-2025-68462

  Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.

  Debian · FreedomBox

  Low3.2
• CVE-2025-8454

  It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the…

  Debian · devscripts

  Critical9.8
• CVE-2025-6297

  dpkg-deb: Fix cleanup for control member with restricted directories

  Debian · dpkg

  High8.2
• CVE-2025-53391

  The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactive/allow_active…

  Debian · zulucrypt

  Critical9.3
• CVE-2014-7210

  pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered that the maintainer scripts of…

  Debian · pdns

  Critical9.8