Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Unknown | n/a | DSA-6583-1 |
libheif security update
DebianDebian Linux, Debian libheif
|
Debian Security Advisories | |||
|
DSA-6583-1libheif security update
Executive summaryDebian has released a security update for libheif, a library used to read and write HEIF and AVIF images. The advisory says that processing specially crafted images could cause denial of service or disclosure of process memory, and it recommends upgrading libheif packages. Technical summaryThe advisory describes multiple security issues in libheif, including denial of service through excessive resource consumption or crashes and disclosure of process memory when processing crafted images. It also addresses a use-after-free and double-free in timestamp handling during image encoding, including transcoding of crafted images. For the stable distribution (trixie), the fixed version is stated as 1.23.6-2~deb13u1. The advisory does not state CVE identifiers, CVSS scores, attack vector details beyond processing crafted images, or workarounds. Detection guidance is not stated, and the advisory refers readers to the Debian security tracker for detailed status. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00499.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6579-1 |
roundcube security update
Debian, RoundcubeDebian Linux, roundcube, Debian roundcube
|
Debian Security Advisories | |||
|
DSA-6579-1CVE-2026-113386CVE-2026-114714CVE-2026-114715CVE-2026-11471615 moreroundcube security update
Executive summaryDebian has released a security update for the roundcube webmail package, which fixes multiple vulnerabilities that could lead to information disclosure, cross-site scripting, or privilege escalation. The advisory does not state a severity rating for these issues. Debian recommends upgrading roundcube packages to the fixed version. Technical summaryThe advisory lists multiple vulnerabilities in roundcube, including IMAP command injection, cross-site scripting, SSRF bypass, email header injection, CSS property injection, remote content blocking bypass, information disclosure, and privilege escalation, spanning twenty CVE identifiers. Attack vector, required privileges, and user interaction are not stated. For Debian stable (trixie), the fixed version is 1.6.20+dfsg-0+deb13u1. No workarounds, detection guidance, or exploitation status are stated, and affected versions prior to the fix are not stated. The advisory points to the Debian security tracker for further status details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00495.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6580-1 |
erlang security update
Debian, erlangDebian Linux, erlang OTP, Debian erlang
|
Debian Security Advisories | |||
|
DSA-6580-1CVE-2026-55951CVE-2026-59696CVE-2026-65634CVE-2026-6635713 moreerlang security update
Executive summaryDebian has released a security update for the erlang package, which provides the Erlang/OTP programming language and runtime. The advisory covers 18 CVEs that could lead to denial of service, HTTP request smuggling, or bypass of authentication and access restrictions, including TLS server impersonation. Debian recommends upgrading the erlang packages to the fixed version for the stable distribution (trixie). Technical summaryThe advisory describes several vulnerabilities in Erlang/OTP affecting the HTTP client and server, SSH, TLS, ASN.1 decoding, the network driver, and URI, LDAP and SNMP parsing, and lists 18 CVE identifiers. The stated impacts are denial of service, HTTP request smuggling, and authentication or access restriction bypass, including TLS server impersonation. The vulnerability classes, attack vectors, and preconditions for each CVE are not stated. For the stable distribution (trixie), the fixed version is 1:27.3.4.1+dfsg-1+deb13u4. The update tightens protocol validation and HTTP/SSH resource limits, and applications relying on previously permissive behavior may need adjustment. No workarounds, detection guidance, or affected version ranges beyond the fixed version are stated, and CVSS scores are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00496.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6581-1 |
unbound security update
DebianDebian Linux, Debian unbound
|
Debian Security Advisories | |||
|
DSA-6581-1CVE-2026-109125CVE-2026-35501CVE-2026-50106CVE-2026-96405unbound security update
Executive summaryDebian has released a security update for the unbound DNS resolver package, which fixes five vulnerabilities. The advisory describes problems including DNSSEC trust bypasses, cache poisoning risk, and denial of service, and it recommends upgrading unbound packages. Technical summaryThe advisory covers five CVEs in Unbound: CVE-2026-35501 allows bypass of a configured island trust anchor underneath an insecure parent via an attacker-controlled NSEC record, and CVE-2026-50106 allows possible insecure NXDOMAIN responses for non-existing records under the same conditions. CVE-2026-96405 is a denial of service from aggregate DNS name chained pointer decompression work, and CVE-2026-97206 is a use-after-free on multi-threaded deployments triggered by DNS-over-QUIC path migration. CVE-2026-109125 is a possible cache poisoning issue via a cache side-channel exposed by 'unwanted-reply-threshold'. Fixed version for Debian trixie is 1.26.2-0+deb13u1. Attack vector details beyond those descriptions, CVSS scores, workarounds, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: NLnet Labs Unbound Summarized from lists.debian.org/debian-security-announce/2026/msg00497.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6582-1 |
brotli security update
Debian, BrotliDebian Linux, Brotli, Debian brotli
|
Debian Security Advisories | |||
|
DSA-6582-1CVE-2026-111497brotli security update
Executive summaryDebian has released a security update for the brotli compression package, which is used in Debian's stable distribution (trixie). The advisory says the flaw could lead to denial of service or possibly arbitrary code execution, and Debian recommends upgrading brotli packages. Technical summaryThe advisory describes a vulnerability in Brotli, a general-purpose lossless compression suite, that could result in denial of service or potentially arbitrary code execution. It is tracked as CVE-2026-111497 with Debian bug 1151690. The vulnerability class, attack vector, and preconditions are not stated. For the stable distribution (trixie), the fixed version is 1.1.0-2+deb13u1. Workarounds are not stated, and no detection guidance is given beyond the recommendation to upgrade brotli packages and consult the Debian security tracker. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00498.html ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6534-3 |
webkit2gtk - regression update security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6534-3webkit2gtk - regression update security update
From the advisoryThe webkit2gtk update released as DSA-6534-1 introduced a regression that prevents Evolution from displaying images embedded in HTML emails. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6577-1 |
chromium security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6577-1CVE-2026-110913CVE-2026-110914CVE-2026-110915CVE-2026-110916358 morechromium security update
From the advisorySecurity issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6578-1 |
aide security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6578-1aide security update
From the advisoryTwo vulnerabilities were discovered in aide, an advanced intrusion detection system, which could allow a local user to bypass the detection of malicious files. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6573-1 |
firefox-esr security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6573-1CVE-2026-113470firefox-esr security update
From the advisoryThis update blocks compromised intermediate certificates issued by the eMudhra CA. Most users will have these certs already blocked by the OneCRL feature provided by Firefox. This update blocks the certificates also for installations which have RemoteSettings disabled or which are unable to connect to the revocation backend service due to network constraints. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6574-1 |
php8.4 security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6574-1CVE-2026-109618CVE-2026-109619php8.4 security update
From the advisoryIt was discovered that incorrect memory state tracking in PHP, a widely-used open source general purpose scripting language, could result in the execution of arbitrary code. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6575-1 |
nginx security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6575-1CVE-2026-15176CVE-2026-93479CVE-2026-95101CVE-2026-97205nginx security update
From the advisorySeveral vulnerabilities were discovered in nginx, a high performance web and reverse proxy server. Depending on the configuration, these could result in memory corruption, denial of service, injection of requests to backend servers, or bypass of client certificate authentication. CVE-2026-15176 Mapping a rewritten request URI to a filesystem path in a location using the alias directive could cause a buffer overflow. CVE-2026-93479 Evaluation of string expressions in the HTTP and stream modules could overwrite reserved buffer space, resulting in a buffer overflow. Affected operations include evaluation of variable document roots and access log paths. The affected code was introduced into the trixie package by an earlier security backport. CVE-2026-95101 Incorrect handling of fragmented unknown HTTP/3 frames could cause their contents to be treated as request body data. When proxying requests, this could allow injection of requests into a backend server or bypass of request body size limits. CVE-2026-97205 A counter tracking pending asynchronous operations could overflow, causing request memory to be freed while still in use. This use-after-free could result in memory corruption or denial of service. CVE-2026-97629 Incomplete synchronisation of TLS session ticket keys between worker processes could leave a worker using uninitialised key material. This could allow forged TLS sessions and bypass of client certificate authentication. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6576-1 |
bind9 security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6576-1CVE-2026-19630CVE-2026-94300CVE-2026-96888CVE-2026-97313bind9 security update
From the advisorySeveral vulnerabilities were discovered in BIND, a DNS server implementation, which could result in denial of service or remote code execution. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6572-1 |
ca-certificates security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6572-1ca-certificates security update
From the advisoryIt was discovered that several eMudhra intermediate CA certificates have been compromised. Updated ca-certificate packages are provided to remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6567-2 |
cifs-utils - regression update security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6567-2cifs-utils - regression update security update
From the advisoryThe update for cifs-utils announced in DSA 6567-1 introduced a regression when using the sec=krb5 and cruid mount options. Updated packages are now available to correct this issue. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6570-1 |
haproxy security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6570-1haproxy security update
From the advisoryTwo vulnerabilities were discovered in HAProxy, a fast and reliable load balancing reverse proxy, which could result in denial of service. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6571-1 |
xen security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6571-1CVE-2026-102699CVE-2026-102700CVE-2026-102702CVE-2026-624376 morexen security update
From the advisoryMultiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation, information disclosure or denial of service. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6565-1 |
spip security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6565-1spip security update
From the advisoryA vulnerability was discovered in SPIP, a website engine for publishing, which could result in unauthenticated remote code execution. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6566-1 |
expat security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6566-1CVE-2026-102633CVE-2026-66046CVE-2026-76956CVE-2026-769571 moreexpat security update
From the advisorySeveral vulnerabilities have been discovered in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a malformed XML file is processed. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6567-1 |
cifs-utils security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6567-1CVE-2026-104715CVE-2026-12505cifs-utils security update
From the advisoryTwo vulnerabilities were discovered in cifs-utils, the Common Internet File System utilities, which could result in privilege escalation. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6568-1 |
linux security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6568-1CVE-2025-38204CVE-2025-40158CVE-2026-52988CVE-2026-72315268 morelinux security update
From the advisorySeveral vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6569-1 |
apache2 security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6569-1CVE-2026-42356CVE-2026-42528CVE-2026-46729CVE-2026-4736014 moreapache2 security update
From the advisoryMultiple vulnerabilities have been discovered in the Apache HTTP server, which may result in denial of service, information disclosure, authentication bypass or HTTP request smuggling. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6562-1 |
chromium security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6562-1CVE-2026-110136CVE-2026-110137CVE-2026-110138CVE-2026-11013932 morechromium security update
From the advisorySecurity issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6563-1 |
mutt security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6563-1CVE-2026-107570mutt security update
From the advisoryIt was discovered that incorrect parsing of Content-Type headers in the Mutt mail user agent could result in denial of service or potentially the execution of arbitrary code. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6564-1 |
jpeg-xl security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6564-1CVE-2026-52584jpeg-xl security update
From the advisoryIt was discovered that missing input sanitising in the APNG parser in the reference code implementation of the JPEG XL format could result in denial of service or information disclosure if malformed images are processed. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||
| Unknown | n/a | DSA-6558-1 |
curl security update
DebianDebian Linux
|
Debian Security Advisories | |||
|
DSA-6558-1CVE-2026-8286CVE-2026-8924CVE-2026-8927CVE-2026-92392curl security update
From the advisoryIt was discovered that the cURL URL transfer library, is prone to a use-after-free vulnerability when handling a HTTP/2 RST_STREAM received by a server during an upload, which could result in remote code execution. ScoreNo CVSS score published. Affects
Debian Security TeamPublished
Read the advisory
|
|||||||