Debian vulnerabilities and fixes

CVEs that mention Debian, ranked by priority. 21 tracked.

Debian has 21 tracked vulnerabilities, 2 critical and 3 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 19. Most recent: 2026-10-23. Highest priority: CVE-2015-3306 (score 100/100).

• CVE-2015-3306 CRITICAL 10.0 EXPLOITED MITIGATE MITIGATE ProFTPD Improper Access Control Vulnerability
• CVE-2025-39682 CRITICAL 9.8 EXPLOITED UPGRADE MITIGATE Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
• CVE-2015-5477 HIGH 7.5 EXPLOITED UPGRADE MITIGATE ISC BIND Data Processing Errors Vulnerability
• CVE-2023-4050 HIGH 7.5 UPGRADE MITIGATE In some cases, an untrusted input stream was copied to a stack buffer without checking its size
• CVE-2023-22795 HIGH 7.5 UPGRADE MITIGATE A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-M
• CVE-2023-27530 HIGH 7.5 UPGRADE MITIGATE A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME
• CVE-2023-27535 MEDIUM 5.9 UPGRADE MITIGATE An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can r
• CVE-2023-27536 MEDIUM 5.9 UPGRADE MITIGATE An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse p
• CVE-2023-28321 MEDIUM 5.9 UPGRADE MITIGATE An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wil
• CVE-2023-23916 MEDIUM 6.5 UPGRADE MITIGATE An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "ch
• CVE-2023-37202 HIGH 8.8 UPGRADE UPGRADE Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be s
• CVE-2023-37211 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12
• CVE-2023-37207 MEDIUM 6.5 UPGRADE UPGRADE A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external
• CVE-2023-4049 MEDIUM 5.9 UPGRADE MITIGATE Race conditions in reference counting code were found through code inspection
• CVE-2023-4045 MEDIUM 5.3 UPGRADE MITIGATE Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data
• CVE-2023-37208 HIGH 7.8 UPGRADE UPGRADE When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code
• CVE-2023-30549 HIGH 7.1 UPGRADE MITIGATE Apptainer is an open source container platform for Linux
• CVE-2026-52817 HIGH 7.0 Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems
• CVE-2023-6915 MEDIUM 6.2 MITIGATE DOWNGRADE A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel
• CVE-2026-12565 MEDIUM 5.3 The unarchive internal module's archive extraction commands perform no code-level validation on extracted file
• CVE-2026-98917 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32k

FAQ

How do I fix Debian vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Debian being exploited right now?

Yes: 3 Debian CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Debian CVE should I patch first?

CVE-2015-3306 currently ranks highest (100/100): ProFTPD Improper Access Control Vulnerability.

← Back to latest CVEs