Vendor
Debian
18,812 known vulnerabilities in products by Debian, 135 of them actively exploited (CISA KEV).
Key figures
18,812
Vulnerabilities
135
Actively exploited (KEV)
14
Used by ransomware
2,139
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2023-46604 | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2025-24813 | Apache Tomcat Path Equivalence Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2024-9680 | Mozilla Firefox Use-After-Free Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2018-7600 | Drupal Core Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2017-7494 | Samba Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2018-7602 | Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2012-0507 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2018-6789 | Exim Buffer Overflow Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-45046 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2021-40438 | mod_proxy SSRF In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2026-85046 | Google Chromium V8 Type Confusion Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2019-11043 | Underflow in PHP-FPM can lead to RCE In CISA KEVRansomware | 8.7 | |
| Critical | CVE-2026-87902 | WordPress Core Remote File Inclusion Vulnerability In CISA KEV | 8.1 | |
| Critical | CVE-2026-2441 | Google Chromium CSS Use-After-Free Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2024-1086 | Linux Kernel Use-After-Free Vulnerability In CISA KEVRansomware | 7.8 | |
| Critical | CVE-2022-30333 | RARLAB UnRAR Directory Traversal Vulnerability In CISA KEVRansomware | 7.5 | |
| Critical | CVE-2026-24061 | GNU InetUtils Argument Injection Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2025-49113 | RoundCube Webmail Deserialization of Untrusted Data Vulnerability In CISA KEV | 9.9 | |
| Critical | CVE-2025-32433 | Erlang/OTP SSH Vulnerable to Pre-Authentication RCE In CISA KEV | 10.0 | |
| Critical | CVE-2025-32463 | Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability In CISA KEV | 9.3 | |
| Critical | CVE-2026-87491 | Google Chromium V8 Out of Bounds Write Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2020-1472 | Netlogon Elevation of Privilege Vulnerability In CISA KEVRansomware | 5.5 | |
| Critical | CVE-2015-3306 | ProFTPD Improper Access Control Vulnerability In CISA KEV | 10.0 |
News
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malwarethehackernews,
- PHP2Shell exposes the weakness in coordinated vulnerability disclosurecsoonline,
- Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAFvmware-security,
- Two critical PHP flaws put the web on alert as emergency patches arrivecsoonline,
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensorssecurityweek,
- PHP ships emergency patches for critical PHP2Shell flawsbleepingcomputer,
Products
| Product | CVEs | Actively exploited |
|---|---|---|
| Debian Linux | 10,011 | 124 |
| Chromium | 2,408 | 1 |
| Linux | 1,675 | 0 |
| Webkit2gtk | 229 | 1 |
| Thunderbird | 111 | 0 |
| Firefox-esr | 93 | 0 |
| Wireshark | 52 | 0 |
| Rsync | 33 | 0 |
| Xen | 33 | 0 |
| Roundcube | 32 | 0 |
| Unbound | 29 | 0 |
| Erlang | 28 | 0 |
| Dovecot | 27 | 0 |
| Debian Advanced Package Tool | 21 | 0 |
| Apache2 | 20 | 0 |
| Nodejs | 19 | 0 |
| Dnsdist | 17 | 0 |
| Pdns-recursor | 17 | 0 |
| Xrdp | 17 | 0 |
| Incus | 16 | 0 |
| Frr | 15 | 0 |
| Spip | 15 | 0 |
| Debian Dpkg | 14 | 0 |
| Libde265 | 12 | 0 |
| Libheif | 12 | 0 |
| Flatpak | 11 | 0 |
| Gimp | 10 | 0 |
| Rails | 10 | 0 |
| Debian StrongSwan | 9 | 0 |
| Ruby-oj | 9 | 0 |
| Tor | 9 | 0 |
| Vips | 9 | 0 |
| Debian shadow | 8 | 0 |
| Netatalk | 8 | 0 |
| Gst-plugins-bad1.0 | 7 | 0 |
| Pdns | 7 | 0 |
| Slurm-wlm | 7 | 0 |
| Debian Lintian | 6 | 0 |
| Dnsmasq | 6 | 0 |
| Expat | 6 | 0 |
| Freecad | 6 | 0 |
| Nagios4 | 6 | 0 |
| Samba | 6 | 0 |
| Apt | 5 | 0 |
| Debian BIND9 | 5 | 0 |
| Ffmpeg | 5 | 0 |
| Lemonldap-ng | 5 | 0 |
| Libyaml-syck-perl | 5 | 0 |
| Mediawiki | 5 | 0 |
| Nginx | 5 | 0 |
| Debian Cifs-Utils | 4 | 0 |
| Gst-plugins-good1.0 | 4 | 0 |
| Ironic | 4 | 0 |
| Kamailio | 4 | 0 |
| Network-manager-l2tp | 4 | 0 |
| Prosody | 4 | 0 |
| Curl | 3 | 0 |
| Debian devscripts | 3 | 0 |
| Debian reportbug | 3 | 0 |
| Fort-validator | 3 | 0 |