What is the debian CNA?

debian is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 642 CVE records since 2005.

How many CVEs has debian published?

debian has published 642 CVE records, including 9 in the last two years.

What is debian's CVE data quality grade?

RadicalNotion.AI grades debian's CVE data quality as F, with an overall completeness score of 8.6%. This reflects how consistently its CVE records include vendor (11.8%), product (20.7%), CVSS (0%), and CWE (2%) information.

What products does debian publish CVEs for?

debian most frequently publishes CVEs for debian linux, ubuntu linux, ImageMagick, fedora, leap.

Which vendors does debian cover?

debian publishes CVEs across 34 distinct vendors, most often Debian, canonical, openSUSE, ImageMagick, fedoraproject.

Is debian actively publishing CVEs?

debian is currently active, based on 9 CVEs in the last two years.

How many critical CVEs has debian published?

debian has published 95 critical-severity CVEs and 232 high-severity CVEs.

Are any of debian's CVEs in CISA's Known Exploited Vulnerabilities catalog?

Yes. 3 of debian's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.

What are the most common weakness types in debian's CVEs?

debian's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-264.

How does debian rank among CNAs?

By total CVE volume, debian ranks #48 of 370 CNAs, and it reports more complete CVE records than 1% of all CNAs.

RadicalNotion.AI

Log in Create an account

Grade F

Active

debian

Name: debian CNA CVE data quality report card
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE Numbering Authority

Latest CVE published August 1, 2025

642

CVEs published

Total assigned

20.5

Years active

2005–2025

N/A

Avg CVSS

Across scored CVEs

9

Recent CVEs

Last 2 years

Overview

debian is a CVE Numbering Authority that has published 642 CVE records since 2005. It is currently classified as active, with 9 CVEs published in the last two years. Its CVE data quality is graded F (8.6% overall completeness).

Among the 370 CNAs tracked here, debian ranks #48 by CVE volume and reports more complete records than 1% of all CNAs.

Data quality report card

Completeness of debian's CVE records across vendor, product, CVSS, and CWE fields.

A CVE record needs only a description to be published. Completeness is how often debian also fills in the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means fewer of this CNA’s CVEs need enriching by hand before you can triage them.

Report card grade

F

8.6%

Overall score

Overall completeness8.6%

Vendor completeness11.8%

Product completeness20.7%

CVSS completeness0%

CWE completeness2%

100%

Update rate

Records revised after publishing

34

Vendor diversity

Distinct vendors covered

222 chars

Avg description length

Per CVE record

2005-02-06

First CVE date

Earliest assignment

2025-08-01

Latest CVE date

Most recent assignment

N/A

Average CVSS

Across scored CVEs

What these scores mean

Vendor completeness: The share of this CNA's CVEs that name an affected vendor.
Product completeness: The share that name a specific affected product.
CVSS completeness: The share that include a CVSS severity score.
CWE completeness: The share mapped to a CWE weakness type.
Update rate: How often this CNA revises CVE records after first publishing them.
Vendor diversity: How many distinct vendors this CNA publishes CVEs for.

Severity and exploitation

How the CVSS severity of debian's published CVEs breaks down, and how many are known to be exploited in the wild.

Critical95

High232

Medium266

Low52

In CISA’s Known Exploited Vulnerabilities catalog

3

3 of debian's CVEs are confirmed exploited in the wild and carry a CISA remediation deadline.

Common weakness types

The CWE weakness categories debian most often assigns to its CVEs. Follow any weakness to its full explanation.

Publishing activity by year

How many CVEs debian has published each year.

2017

135

2018

44

2019

33

2020

14

2021

1

2022

5

2025

9

2026

3

Top vendors

The vendors debian publishes the most CVEs for.

Debian200 CVEs
canonical60 CVEs
openSUSE46 CVEs
ImageMagick42 CVEs
fedoraproject41 CVEs
Linux31 CVEs
mediawiki30 CVEs
GNU27 CVEs

Top products

The products debian publishes the most CVEs for.

debian linux168 CVEs
ubuntu linux58 CVEs
ImageMagick42 CVEs
fedora41 CVEs
leap31 CVEs
linux kernel31 CVEs
mediawiki30 CVEs
imagemagick629 CVEs

Latest CVEs

The most recent CVEs assigned by debian.

CVE-2026-11853CWE-59
Medium · CVSS 6.5
EPSS 0.3%2026-06-10
CVE-2026-11852CWE-862
Medium · CVSS 6.5
EPSS 0.2%2026-06-10
CVE-2026-2219CWE-835
High · CVSS 7.5
EPSS 0.4%2026-03-07
CVE-2025-8454CWE-347
Critical · CVSS 9.8
EPSS 0.2%2025-08-01
CVE-2025-6297CWE-732
dpkg-deb: Fix cleanup for control member with restricted directories
High · CVSS 8.2
EPSS 0.4%2025-07-01
CVE-2015-0849CWE-377
Low · CVSS 3.9
EPSS 0.1%2025-06-26
CVE-2015-0843CWE-120
Critical · CVSS 9.8
EPSS 0.4%2025-06-26
CVE-2015-0842CWE-89
Critical · CVSS 9.8
EPSS 0.4%2025-06-26
CVE-2014-6274CWE-311
High · CVSS 7.5
EPSS 0.2%2025-06-26
CVE-2014-7210CWE-276
Critical · CVSS 9.8
EPSS 0.5%2025-06-26
CVE-2014-0468CWE-434
Critical · CVSS 9.8
EPSS 0.5%2025-06-26
CVE-2013-1424CWE-120
Medium · CVSS 5.6
EPSS 0.3%2025-06-26

Get an alert for each new debian CVE, with AI-written analysis and remediation steps.

Monitor debian CVEs

Other CNAs

Data quality for other CVE Numbering Authorities.

mitreGrade F · 112,208 CVEs PatchstackGrade A · 14,729 CVEs VulDBGrade A · 12,140 CVEs microsoftGrade F · 11,701 CVEs redhatGrade F · 10,745 CVEs GitHub_MGrade A · 10,605 CVEs LinuxGrade F · 10,294 CVEs WordfenceGrade A · 8,652 CVEs

Browse all CNAs

Frequently asked questions

Common questions about the debian CNA.

What is the debian CNA?: debian is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 642 CVE records since 2005.
How many CVEs has debian published?: debian has published 642 CVE records, including 9 in the last two years.
What is debian's CVE data quality grade?: RadicalNotion.AI grades debian's CVE data quality as F, with an overall completeness score of 8.6%. This reflects how consistently its CVE records include vendor (11.8%), product (20.7%), CVSS (0%), and CWE (2%) information.
What products does debian publish CVEs for?: debian most frequently publishes CVEs for debian linux, ubuntu linux, ImageMagick, fedora, leap.
Which vendors does debian cover?: debian publishes CVEs across 34 distinct vendors, most often Debian, canonical, openSUSE, ImageMagick, fedoraproject.
Is debian actively publishing CVEs?: debian is currently active, based on 9 CVEs in the last two years.
How many critical CVEs has debian published?: debian has published 95 critical-severity CVEs and 232 high-severity CVEs.
Are any of debian's CVEs in CISA's Known Exploited Vulnerabilities catalog?: Yes. 3 of debian's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.
What are the most common weakness types in debian's CVEs?: debian's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-20 (Improper Input Validation), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-264.
How does debian rank among CNAs?: By total CVE volume, debian ranks #48 of 370 CNAs, and it reports more complete CVE records than 1% of all CNAs.

References

CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.

Track debian CVEs

Get an alert when this CNA publishes a new CVE, with AI-written analysis and remediation steps.

Create an account See pricing