CVE coverage
Debian 12 CVE tracker
Noxen pulls Debian 12 (Bookworm) CVE data from OSV.dev's Debian ecosystem feed, which mirrors the Debian Security Tracker. Records are deduped against NVD and shipped in a signed snapshot, rebuilt daily.
Live
Headline numbers
- Total CVE records (all distros)Loading…
- Last buildLoading…
- OSV records (Debian + others)Loading…
- NVD records (cross-platform)Loading…
How matching works
What Noxen does for a Debian 12 host
- Reads
/etc/os-releaseover SSH to confirm the host is on Debian 12. - Reads the dpkg package list - every binary package, plus its corresponding source package via
dpkg-query --showformat='${Source}'. - Filters the local feed cache to OSV records tagged with ecosystem
Debian:12. - For each record, compares your installed version against the OSV-published fix version using the Debian/Ubuntu version-comparison rules (epoch, upstream, debian-revision).
- Emits a finding only when the installed version is older than the fix. Where Ubuntu Pro / ESM-only fixes apply, they are flagged separately.
Live listings
Top recent critical CVEs (Debian 12 / Debian ecosystem)
Most-recently-published critical CVEs in the Debian 12 / Debian ecosystem. Auto-deduped to one row per CVE ID. Snapshot baked at ; live re-fetch on page load.
| CVE | Sev. | CVSS | Summary | Package | Fix in | Published |
|---|---|---|---|---|---|---|
| DEBIAN-CVE-2026-119263 | critical | 9.6 | Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | chromium | - | |
| DEBIAN-CVE-2026-119261 | critical | 9.6 | Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | chromium | - | |
| DEBIAN-CVE-2026-99154 | critical | 9.8 | In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bou | linux | - | |
| DEBIAN-CVE-2026-99153 | critical | 9.8 | In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy | linux | - | |
| DEBIAN-CVE-2026-110879 | critical | 9.8 | jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses | jackson-databind | - | |
| DEBIAN-CVE-2026-118355 | critical | 9.6 | Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | chromium | 156.0.8078.73-1~deb12u1 | |
| DEBIAN-CVE-2026-118342 | critical | 9.6 | Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | chromium | 156.0.8078.73-1~deb12u1 | |
| DEBIAN-CVE-2026-118340 | critical | 9.6 | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | chromium | 156.0.8078.73-1~deb12u1 |
Top recent high-severity CVEs (Debian 12 / Debian ecosystem)
| CVE | Sev. | CVSS | Summary | Package | Fix in | Published |
|---|---|---|---|---|---|---|
| DEBIAN-CVE-2026-54161 | high | 8.1 | nut | - | ||
| DEBIAN-CVE-2026-99269 | high | 7.8 | linux | - | ||
| DEBIAN-CVE-2026-99264 | high | 7.8 | linux | 6.12.115-1 | ||
| DEBIAN-CVE-2026-99246 | high | 8.1 | linux | - | ||
| DEBIAN-CVE-2026-120830 | high | 7.4 | A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed | libslirp | - | |
| DEBIAN-CVE-2026-120752 | high | 7.5 | PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout a | pymupdf | - | |
| DEBIAN-CVE-2026-29508 | high | 8.8 | ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size va | minidlna | - | |
| DEBIAN-CVE-2026-120065 | high | 7.1 | For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in | psqlodbc | - |
Notable
Recent CVEs Debian 12 operators should know.
- CVE-2024-6387 (regreSSHion) - OpenSSH signal-handler race producing pre-auth RCE.. Debian advisory · Noxen deep-dive.
- CVE-2024-3094 (xz backdoor) - Supply-chain backdoor in xz-utils 5.6.0 / 5.6.1.. Debian advisory · Noxen deep-dive.
- CVE-2024-1086 (nf_tables UAF) - Linux kernel privilege-escalation, observed in the wild.. Debian advisory.
FAQ
Frequently asked about Debian 12 CVEs
How many CVEs affect Debian 12?
Debian 12 (Bookworm) is filtered out of the broader Debian ecosystem feed by ecosystem tag (Debian:12). Live counts appear at the top of this page; the underlying feed is rebuilt daily.
How do I check Debian 12 CVEs on a running host?
For a quick check: apt list --upgradable 2>/dev/null | grep -ci security. For a per-CVE breakdown with fix versions, Noxen reads dpkg over SSH and matches installed source-package versions against the OSV Debian:12 ecosystem feed.
Scan a Debian 12 fleet with Noxen
Add your Debian 12 hosts via your existing
~/.ssh/config; Noxen reads dpkg state and
matches against the live signed feed. No agent, no SaaS round-trip.
$12/month, or $120/year.