Debian — vulnerability landscape

Every CVE-affected package in the Debian ecosystem, sorted by risk.

Last updated 6/4/2026, 1:45:43 PM

#	Package	CVEs	KEV	Max EPSS
1	chromium	2575	62	93.3%
2	webkit2gtk	678	38	89.9%
3	wpewebkit	315	36	82.8%
4	linux	14217	30	94.3%
5	firefox-esr	953	11	93.3%
6	roundcube	87	11	93.3%
7	thunderbird	901	10	93.3%
8	linux-6.1	2962	6	40.3%
9	apache2	235	5	94.4%
10	exim4	68	5	93.9%
11	imagemagick	710	3	93.6%
12	graphicsmagick	142	3	93.6%
13	tomcat9	78	3	94.5%
14	activemq	34	3	94.4%
15	drupal7	33	3	94.5%
16	bash	16	3	94.2%
17	samba	198	2	94.4%
18	rails	113	2	94.3%
19	freetype	94	2	93.0%
20	chromium-browser	61	2	66.9%
21	tomcat10	52	2	94.4%
22	sudo	47	2	92.6%
23	lucene-solr	17	2	94.5%
24	open-vm-tools	17	2	2.9%
25	policykit-1	16	2	88.1%
26	apache-log4j2	10	2	94.4%
27	salt	6	2	94.4%
28	php-pear	6	2	93.4%
29	phpmyadmin	256	1	93.3%
30	openssl	252	1	94.5%
31	ghostscript	162	1	92.9%
32	glibc	158	1	93.9%
33	cacti	156	1	94.5%
34	zabbix	117	1	93.7%
35	otrs2	103	1	34.7%
36	php5	79	1	94.1%
37	trafficserver	73	1	94.4%
38	redis	68	1	94.4%
39	nginx	62	1	94.4%
40	linux-2.6	62	1	49.9%
41	git	53	1	83.0%
42	libspring-java	51	1	94.4%
43	netty	39	1	94.4%
44	jetty9	37	1	94.4%
45	libxstream-java	37	1	94.3%
46	erlang	35	1	93.5%
47	haproxy	35	1	94.4%
48	libvpx	26	1	8.7%
49	dnsdist	26	1	94.4%
50	varnish	22	1	94.4%
51	tomcat7	21	1	94.4%
52	shiro	19	1	94.3%
53	openjdk-6	16	1	93.5%
54	libwebp	16	1	93.3%
55	linux-4.9	15	1	80.4%
56	php7.0	13	1	94.1%
57	h2o	13	1	94.4%
58	unrar-nonfree	13	1	92.8%
59	linux-5.10	13	1	50.6%
60	php7.3	13	1	94.1%
61	node-systeminformation	13	1	94.0%
62	inetutils	12	1	92.6%
63	grpc	10	1	94.4%
64	libphp-phpmailer	10	1	94.4%
65	opensmtpd	9	1	94.1%
66	nghttp2	9	1	94.4%
67	adminer	8	1	94.1%
68	rar	6	1	92.8%
69	node-jquery	3	1	34.7%
70	libimage-exiftool-perl	3	1	92.8%
71	phpunit	3	1	94.2%
72	libspreadsheet-parseexcel-perl	1	1	55.7%
73	pdf.js	1	1	71.6%
74	wireshark	712	—	79.8%
75	xen	452	—	89.7%
76	qemu	449	—	88.6%
77	ffmpeg	380	—	56.2%
78	gpac	356	—	1.5%
79	wordpress	346	—	93.7%
80	binutils	285	—	22.7%
81	mediawiki	276	—	58.4%
82	tiff	268	—	68.7%
83	vim	232	—	54.1%
84	asterisk	198	—	87.1%
85	tcpdump	187	—	72.7%
86	curl	172	—	68.0%
87	openjdk-11	172	—	11.0%
88	clamav	157	—	88.3%
89	freerdp2	151	—	14.3%
90	python-django	144	—	92.8%
91	golang-1.15	135	—	69.9%
92	poppler	133	—	39.9%
93	bind9	132	—	92.8%
94	xorg-server	129	—	23.9%
95	krb5	126	—	92.6%
96	hdf5	122	—	1.3%
97	squid	121	—	86.2%
98	cups	120	—	74.1%
99	vlc	120	—	86.2%
100	nvidia-graphics-drivers	117	—	94.3%
101	libxml2	116	—	56.6%
102	texlive-bin	109	—	16.2%
103	wolfssl	108	—	93.5%
104	golang-1.19	106	—	69.9%
105	tor	99	—	17.0%
106	nodejs	98	—	89.4%
107	openjdk-17	97	—	34.3%
108	openssh	96	—	90.4%
109	ntp	94	—	92.1%
110	intel-microcode	91	—	88.6%
111	zoneminder	87	—	78.2%
112	libvirt	83	—	20.2%
113	gtkwave	82	—	0.2%
114	python2.7	82	—	45.1%
115	pidgin	82	—	39.0%
116	symfony	82	—	88.7%
117	nss	81	—	93.5%
118	suricata	81	—	37.4%
119	libarchive	81	—	38.3%
120	mariadb-10.5	78	—	48.9%
121	openjpeg2	78	—	6.6%
122	gimp	78	—	88.8%
123	exiv2	77	—	12.8%
124	xpdf	77	—	31.2%
125	nasm	75	—	16.4%
126	perl	75	—	82.0%
127	freerdp3	73	—	1.4%
128	openexr	72	—	25.3%
129	spip	71	—	93.4%
130	dovecot	71	—	38.3%
131	jackson-databind	69	—	84.9%
132	ansible	69	—	10.1%
133	nvidia-graphics-drivers-tesla-460	67	—	1.2%
134	pypy3	66	—	7.3%
135	libreoffice	66	—	92.3%
136	nvidia-graphics-drivers-tesla-470	66	—	1.2%
137	nvidia-graphics-drivers-tesla-450	66	—	6.6%
138	python3.9	65	—	7.3%
139	nvidia-graphics-drivers-tesla-418	65	—	6.6%
140	gnutls28	64	—	93.5%
141	libraw	63	—	5.2%
142	virtuoso-opensource	63	—	0.5%
143	assimp	62	—	0.3%
144	grub2	62	—	4.7%
145	mbedtls	62	—	8.4%
146	nova	62	—	87.2%
147	systemd	61	—	43.7%
148	sqlite3	61	—	54.8%
149	php7.4	60	—	29.4%
150	libde265	60	—	0.5%
151	netatalk	59	—	88.8%
152	pillow	59	—	5.3%
153	libpodofo	57	—	5.8%
154	iceweasel	57	—	83.3%
155	mupdf	57	—	34.5%
156	pdns-recursor	56	—	70.8%
157	nvidia-graphics-drivers-tesla	56	—	0.2%
158	nvidia-graphics-drivers-legacy-390xx	55	—	6.6%
159	nvidia-open-gpu-kernel-modules	55	—	0.2%
160	freeimage	54	—	3.6%
161	libgd2	53	—	87.9%
162	icedove	53	—	83.3%
163	golang-1.24	53	—	0.3%
164	opensc	52	—	1.1%
165	pcre3	52	—	21.0%
166	request-tracker4	51	—	2.3%
167	xwayland	51	—	3.0%
168	keystone	51	—	4.0%
169	undertow	51	—	22.7%
170	gst-plugins-good1.0	51	—	19.9%
171	subversion	51	—	86.6%
172	389-ds-base	51	—	14.7%
173	tcpreplay	50	—	1.5%
174	libsoup3	50	—	1.2%
175	edk2	50	—	1.3%
176	libsixel	50	—	0.9%
177	python3.11	49	—	3.0%
178	kubernetes	49	—	91.2%
179	wpa	49	—	16.4%
180	docker.io	49	—	71.9%
181	expat	48	—	11.0%
182	ruby-rack	48	—	16.1%
183	frr	48	—	5.6%
184	unbound	48	—	43.7%
185	libsoup2.4	48	—	4.5%
186	redmine	47	—	73.6%
187	mutt	47	—	13.4%
188	u-boot	47	—	2.0%
189	dnsmasq	47	—	93.4%
190	nvidia-cuda-toolkit	46	—	0.6%
191	libstb	46	—	1.2%
192	openjdk-21	46	—	2.1%
193	openimageio	45	—	15.8%
194	busybox	45	—	16.5%
195	postgresql-13	45	—	82.4%
196	pdns	45	—	85.5%
197	cgal	45	—	4.3%
198	strongswan	45	—	13.6%
199	matrix-synapse	44	—	13.2%
200	libvncserver	44	—	37.7%
201	rust-coreutils	44	—	0.0%
202	w3m	44	—	13.8%
203	python3.13	43	—	3.0%
204	mplayer	42	—	68.1%
205	dwarfutils	42	—	2.7%
206	file	41	—	41.9%
207	biosig	41	—	1.6%
208	golang-1.25	41	—	0.1%
209	puppet	41	—	5.8%
210	freeradius	41	—	30.2%
211	libxmltok	40	—	11.0%
212	glib2.0	40	—	36.1%
213	openldap	39	—	71.5%
214	php8.2	39	—	29.4%
215	libsndfile	38	—	58.5%
216	bluez	37	—	36.5%
217	dokuwiki	37	—	39.0%
218	ruby2.7	37	—	8.8%
219	lighttpd	37	—	93.5%
220	ntfs-3g	36	—	8.3%
221	faad2	36	—	6.6%
222	bouncycastle	36	—	68.1%
223	icu	36	—	41.9%
224	blender	36	—	6.2%
225	ceph	36	—	18.0%
226	rsync	36	—	44.3%
227	yasm	36	—	0.7%
228	firmware-nonfree	36	—	47.5%
229	proftpd-dfsg	36	—	93.7%
230	incus	35	—	0.3%
231	openafs	35	—	9.9%
232	exempi	35	—	2.9%
233	upx-ucl	35	—	0.5%
234	libssh	35	—	78.3%
235	irssi	34	—	6.9%
236	postgresql-15	34	—	82.4%
237	pytorch	33	—	25.1%
238	fig2dev	32	—	0.7%
239	libxslt	32	—	22.1%
240	xulrunner	32	—	48.6%
241	tomcat11	32	—	12.9%
242	elfutils	32	—	3.5%
243	openvpn	32	—	5.5%
244	hoteldruid	32	—	43.8%
245	gdk-pixbuf	32	—	31.1%
246	qtbase-opensource-src	31	—	7.1%
247	python-aiohttp	31	—	93.5%
248	net-snmp	31	—	27.4%
249	xrdp	30	—	2.8%
250	opencv	30	—	5.5%
251	fontforge	30	—	23.1%
252	qemu-kvm	30	—	19.3%
253	ncurses	29	—	7.3%
254	fastdds	29	—	1.3%
255	libextractor	29	—	31.0%
256	libexif	29	—	32.1%
257	sdl-image1.2	29	—	23.4%
258	sox	29	—	48.5%
259	libpng1.6	29	—	4.1%
260	putty	29	—	54.2%
261	libsass	28	—	3.1%
262	dcmtk	28	—	5.7%
263	dbus	28	—	36.1%
264	libsdl2-image	28	—	8.9%
265	qt4-x11	28	—	15.3%
266	glusterfs	27	—	10.8%
267	ring	27	—	1.7%
268	python3.14	27	—	0.2%
269	privoxy	27	—	3.5%
270	evolution	27	—	34.5%
271	graphite2	27	—	2.4%
272	golang-go.crypto	27	—	54.2%
273	moin	27	—	49.7%
274	ruby3.1	27	—	8.8%
275	avahi	27	—	77.1%
276	simplesamlphp	27	—	1.9%
277	lrzip	27	—	1.0%
278	rubygems	27	—	27.1%
279	pypdf2	26	—	0.2%
280	mapserver	26	—	11.5%
281	p7zip	26	—	54.7%
282	jruby	26	—	7.3%
283	neutron	26	—	14.3%
284	kanboard	26	—	5.2%
285	libheif	25	—	0.4%
286	glance	25	—	3.6%
287	postgresql-17	25	—	82.4%
288	binaryen	25	—	0.5%
289	mruby	25	—	1.4%
290	node-axios	25	—	13.1%
291	consul	25	—	87.8%
292	mosquitto	25	—	23.1%
293	awstats	25	—	92.0%
294	openjdk-7	25	—	93.5%
295	heimdal	25	—	92.6%
296	jhead	25	—	2.0%
297	libytnef	25	—	2.4%
298	ccextractor	25	—	0.9%
299	gnupg2	25	—	35.3%
300	pypdf	25	—	0.2%