Vulnerability Database

317,182

Total vulnerabilities in the database

CVE-2025-8454

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.

  • Published: Aug 1, 2025
  • Updated: Nov 16, 2025
  • CVE: CVE-2025-8454
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.8
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWEs:

Software From Fixed in
debian / devscripts 2.25.15 2.25.15.x