This Week

Patch now CVE-2026-123218 IBM Aspera Faspex 9.8 exploited
Patch now CVE-2026-116779 SignalWire FreeSwitch 9.8 exploited
Patch now CVE-2026-116606 Barracuda Networks Barracuda Email Security Gateway (ESG) 9.8 exploited
Patch now CVE-2026-102895 GPUStack GPUStack 9.8 exploited
Patch now CVE-2026-125350 Google Chromium 8.8 exploited
Patch now CVE-2026-123158 OpenSSH 8.1 exploited
Patch now CVE-2026-20320 Cisco BroadWorks 7.5 exploited
Patch now CVE-2026-19868 SonicWall SonicOS SSLVPN 7.5 exploited
Patch now CVE-2026-111560 Barracuda Networks Multiple Products 7.2 exploited
Patch now CVE-2026-124194 Microsoft Office 6.5 exploited
Patch now CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder 4.3 exploited
Patch now CVE-2026-124815 Clockinator Lite 10.0
Patch now CVE-2026-118423 WP Libre Form 10.0
Patch now CVE-2026-115252 Confection WordPress Cable 10.0

Patch now CVE-2026-123218 IBM Aspera Faspex 9.8 exploited
Patch now CVE-2026-116779 SignalWire FreeSwitch 9.8 exploited
Patch now CVE-2026-116606 Barracuda Networks Barracuda Email Security Gateway (ESG) 9.8 exploited
Patch now CVE-2026-102895 GPUStack GPUStack 9.8 exploited
Patch now CVE-2026-125350 Google Chromium 8.8 exploited
Patch now CVE-2026-123158 OpenSSH 8.1 exploited
Patch now CVE-2026-20320 Cisco BroadWorks 7.5 exploited
Patch now CVE-2026-19868 SonicWall SonicOS SSLVPN 7.5 exploited
Patch now CVE-2026-111560 Barracuda Networks Multiple Products 7.2 exploited
Patch now CVE-2026-124194 Microsoft Office 6.5 exploited
Patch now CVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder 4.3 exploited
Patch now CVE-2026-124815 Clockinator Lite 10.0
Patch now CVE-2026-118423 WP Libre Form 10.0
Patch now CVE-2026-115252 Confection WordPress Cable 10.0

Software · Ubuntu / Debian packages

Ubuntu and Debian Package Vulnerabilities

The latest security flaws in Ubuntu and Debian packages, and how to keep a Ubuntu or Debian server patched and on a supported release.

New flaws, 30 days: 0
Critical, 8 weeks: 0
On CISA's exploited list: 58
Latest exploited: 8 Oct 2026

Ubuntu and Debian Security in Short

Ubuntu and Debian fix security flaws in their own packages, usually by adding the fix to the version they shipped rather than moving to a new version. So apt keeps you safe as long as two things are true: updates are being installed, and your release is still supported.

How to Keep Ubuntu and Debian Patched

Turn on unattended-upgrades for security updates. Check /var/log/unattended-upgrades/ now and then to see it's working.
Reboot after kernel updates (/var/run/reboot-required appears when one is needed) and restart services after library updates (needrestart).
Know when your release stops getting updates. Ubuntu LTS releases get five years of standard support; Debian releases get about three years, then two more of LTS. See Bobble Solutions' end-of-life tracker for dates.

The Past Eight Weeks

Any Score 7+ 8+ 9+

1 flaw scored 8+, newest first.

Listed 8 Oct 2026 Access control flaw The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the sit… CVE-2015-3306 10.0 Exploited

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Patch now · NVD Record

Being Exploited

Ubuntu / Debian packages flaws CISA has added to its list of flaws attackers are using in the past six months, newest first. See all 58 on the KEV page.

Patch now

Ubuntu / Debian packages

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and si…

Score 10.0 / 10 · Being exploited

CVE-2015-3306

Rather not patch it yourself?

Bobble Solutions patches, backs up and watches Linux servers and WordPress sites.

Talk to Bobble Solutions