NIXPKGS-2026-2006

GitHub issue published 13 hours ago

Hydra - Stack Buffer Overflow in NTLM Authentication Handler

Permalink CVE-2026-56766

8.6 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Hydra - Stack Buffer Overflow in NTLM Authentication Handler

Patch Commit patch
https://www.vulncheck.com/advisories/hydra-stack-buffer-overflow-in-ntlm-authen… third-party-advisory

thc-hydra

==9cc84c20e75f5fef6bb1790bb9ada2afad2204e2
=<9.7

NIXPKGS-2026-2005

GitHub issue published 13 hours ago

socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser

          Permalink
          
            CVE-2026-56123
          
        9.2 CRITICAL
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): High (H)
        
          Vulnerable System Impact Integrity (VI): High (H)
        
          Vulnerable System Impact Availability (VA): High (H)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): High (H)
        
          Modified Vulnerable System Impact Integrity (MVI): High (H)
        
          Modified Vulnerable System Impact Availability (MVA): High (H)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          13 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          21 hours ago
          
          @LeSuisse
          
              ignored
            
              package websocat
            
          13 hours ago
          
          @LeSuisse
          
              accepted
            
          13 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          13 hours ago
          
            socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser
          
      http://www.dest-unreach.org/socat/CHANGES
    
    release-notespatch
  
      https://www.vulncheck.com/advisories/socat-heap-buffer-overflow-via-socks5-repl…
    
    third-party-advisory
  
    socat

            <1.8.1.2

NIXPKGS-2026-2004

GitHub issue published 13 hours ago

Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy

Permalink CVE-2026-54573

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse ignored
17 packages
- go-outline
- mdbook-pdf-outline
- typstPackages.suboutline
- python312Packages.outlines
- python313Packages.outlines
- typstPackages.suboutline_0_1_0
- typstPackages.suboutline_0_2_0
- typstPackages.suboutline_0_3_0
- mplus-outline-fonts.osdnRelease
- python312Packages.outlines-core
- python313Packages.outlines-core
- python314Packages.outlines-core
- typstPackages.outline-summaryst
- mplus-outline-fonts.githubRelease
- pkgsRocm.python3Packages.outlines
- typstPackages.outline-summaryst_0_1_0
- pkgsRocm.python3Packages.outlines-core
13 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy

https://github.com/outline/outline/security/advisories/GHSA-5x79-rj4g-qrh8 x_refsource_CONFIRM

outline

==< 1.8.0

Needs some backports

NIXPKGS-2026-2003

GitHub issue published 13 hours ago

Halo: Path Traversal in Backup Download Leads to Arbitrary File Read

          Permalink
          
            CVE-2026-55439
          
        5.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): High (H)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): None (N)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): High (H)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          13 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          21 hours ago
          
          @LeSuisse
          
              ignored
            
                14 packages
                eschalot
python312Packages.halo
python313Packages.halo
python314Packages.halo
typstPackages.whalogen
python312Packages.halohome
python313Packages.halohome
python314Packages.halohome
typstPackages.whalogen_0_1_0
typstPackages.whalogen_0_2_0
typstPackages.whalogen_0_3_0
python312Packages.django-cachalot
python313Packages.django-cachalot
python314Packages.django-cachalot

          13 hours ago
          
          @LeSuisse
          
              accepted
            
          13 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          13 hours ago
          
            Halo: Path Traversal in Backup Download Leads to Arbitrary File Read
          
      https://github.com/halo-dev/halo/security/advisories/GHSA-h8wj-chr2-hf66
    
    x_refsource_CONFIRM
  
      https://github.com/halo-dev/halo/issues/10064
    
    x_refsource_MISCexploit
  
    halo

            ==< 2.24.3

NIXPKGS-2026-2002

GitHub issue published 13 hours ago

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

          Permalink
          
            CVE-2026-54917
          
        7.8 HIGH
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): High (H)
        
          Subsequent System Impact Integrity (SI): High (H)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): High (H)
        
          Modified Subsequent System Impact Integrity (MSI): High (H)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          13 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          21 hours ago
          
          @LeSuisse
          
              accepted
            
          13 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          13 hours ago
          
            SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
          
      https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
    
    x_refsource_CONFIRMexploit
  
      https://github.com/seaweedfs/seaweedfs/pull/9687
    
    x_refsource_MISC
  
    seaweedfs

            ==< 4.30
          
          Needs some backports

NIXPKGS-2026-2001

GitHub issue published 13 hours ago

Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID

          Permalink
          
            CVE-2026-56774
          
        5.3 MEDIUM
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): Low (L)
        
          Vulnerable System Impact Availability (VA): Low (L)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): Low (L)
        
          Modified Vulnerable System Impact Availability (MVA): Low (L)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          13 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          21 hours ago
          
          @LeSuisse
          
              accepted
            
          13 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          13 hours ago
          
            Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID
          
      Researcher Disclosure
    
    technical-descriptionexploit
  
      Pull Request
    
    issue-tracking
  
      Patch Commit
    
    patch
  
      https://www.vulncheck.com/advisories/kanboard-cross-user-deletion-of-persistent…
    
    third-party-advisory
  
    kanboard

            ==928c68aa2b7c00092dd71084d329b912e229f3d1
          
            =<1.2.52

NIXPKGS-2026-2000

GitHub issue published 13 hours ago

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Permalink CVE-2026-49980

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 21 hours ago
@LeSuisse ignored
9 packages
- librclone
- rclone-ui
- syncrclone
- rclone-browser
- git-annex-remote-rclone
- gnomeExtensions.rclone-manager
- python312Packages.rclone-python
- python313Packages.rclone-python
- python314Packages.rclone-python
13 hours ago
@LeSuisse ignored maintainer @SuperSandro2000 13 hours ago maintainer.ignore
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv x_refsource_CONFIRM

rclone

==>= 1.46.0, < 1.74.3

NIXPKGS-2026-1999

GitHub issue published 13 hours ago

trivy: security issues < 0.71.1

          Permalink
          
            CVE-2026-54448
          
        6.9 MEDIUM
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Active (A)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): High (H)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Active (A)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): High (H)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          13 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          21 hours ago
          
          @LeSuisse
          
              ignored
            
              package lazytrivy
            
          13 hours ago
          
          @LeSuisse
          
              accepted
            
          13 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          13 hours ago
          
            Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
          
      https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4
    
    x_refsource_CONFIRMexploit
  
      https://github.com/aquasecurity/trivy/pull/10718
    
    x_refsource_MISCexploit
  
    trivy

            ==< 0.71.0

Permalink CVE-2026-55092

7.0 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse ignored package lazytrivy 13 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts

https://github.com/aquasecurity/trivy/security/advisories/GHSA-mcj4-mphf-j9ff x_refsource_CONFIRM

trivy

==< 0.71.1

NIXPKGS-2026-1998

GitHub issue published 13 hours ago

rubyPackages.nokogiri: security issues < 1.19.4

Permalink CVE-2026-57435

1.7 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Unreported (U)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp x_refsource_CONFIRM

nokogiri

==< 1.19.4

Permalink CVE-2026-57434

1.7 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Unreported (U)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-9cv2-cfxc-v4v2 x_refsource_CONFIRM

nokogiri

==< 1.19.4

Permalink CVE-2026-57437

1.7 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Unreported (U)
Provider Urgency (U): Clear (Clear)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-p67v-3w7g-wjg7 x_refsource_CONFIRM

nokogiri

==< 1.19.4

Permalink CVE-2026-57236

1.7 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Unreported (U)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p x_refsource_CONFIRM

nokogiri

==< 1.19.4

Permalink CVE-2026-57235

6.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5prr-v3j2-97mh x_refsource_CONFIRM

nokogiri

==< 1.19.4

Permalink CVE-2026-57436

1.7 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Unreported (U)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wjv4-x9w8-wm3h x_refsource_CONFIRM

nokogiri

==< 1.19.4

Permalink CVE-2026-57438

2.2 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Unreported (U)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Nokogiri: Possible Use-After-Free in XInclude Processing

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wfpw-mmfh-qq69 x_refsource_CONFIRM

nokogiri

==< 1.19.4

Permalink CVE-2026-57234

2.6 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2 x_refsource_CONFIRM

nokogiri

==< 1.19.4

NIXPKGS-2026-1997

GitHub issue published 13 hours ago

jq: security issues < 1.8.2

Permalink CVE-2026-47770

6.8 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse ignored
35 packages
- ijq
- jql
- jqp
- njq
- gojq
- jqfmt
- jq-lsp
- jquake
- jq-zsh-plugin
- python312Packages.jq
- python313Packages.jq
- python314Packages.jq
- python312Packages.llm-jq
- python313Packages.llm-jq
- python314Packages.llm-jq
- haskellPackages.js-jquery
- python312Packages.xstatic-jquery
- python313Packages.xstatic-jquery
- python314Packages.xstatic-jquery
- python312Packages.django-jquery-js
- python313Packages.django-jquery-js
- python314Packages.django-jquery-js
- python312Packages.xstatic-jquery-ui
- python313Packages.xstatic-jquery-ui
- python314Packages.xstatic-jquery-ui
- tree-sitter-grammars.tree-sitter-jq
- vimPlugins.nvim-treesitter-parsers.jq
- python312Packages.sphinxcontrib-jquery
- python313Packages.sphinxcontrib-jquery
- python314Packages.sphinxcontrib-jquery
- python312Packages.xstatic-jquery-file-upload
- python313Packages.xstatic-jquery-file-upload
- python314Packages.xstatic-jquery-file-upload
- python313Packages.tree-sitter-grammars.tree-sitter-jq
- python314Packages.tree-sitter-grammars.tree-sitter-jq
13 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse ignored
4 maintainers
- @ncfavier
- @7c6f434c
- @Artturin
- @06kellyjac
13 hours ago maintainer.ignore
@LeSuisse published on GitHub 13 hours ago

jq: stack overflow in deep structural equality

https://github.com/jqlang/jq/security/advisories/GHSA-3pgx-frr7-3jxp x_refsource_CONFIRM

jq

==< 1.8.2

Permalink CVE-2026-54679

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse ignored
35 packages
- ijq
- jql
- jqp
- njq
- gojq
- jqfmt
- jq-lsp
- jquake
- jq-zsh-plugin
- python312Packages.jq
- python313Packages.jq
- python314Packages.jq
- python312Packages.llm-jq
- python313Packages.llm-jq
- python314Packages.llm-jq
- haskellPackages.js-jquery
- python312Packages.xstatic-jquery
- python313Packages.xstatic-jquery
- python314Packages.xstatic-jquery
- python312Packages.django-jquery-js
- python313Packages.django-jquery-js
- python314Packages.django-jquery-js
- python312Packages.xstatic-jquery-ui
- python313Packages.xstatic-jquery-ui
- python314Packages.xstatic-jquery-ui
- tree-sitter-grammars.tree-sitter-jq
- vimPlugins.nvim-treesitter-parsers.jq
- python312Packages.sphinxcontrib-jquery
- python313Packages.sphinxcontrib-jquery
- python314Packages.sphinxcontrib-jquery
- python312Packages.xstatic-jquery-file-upload
- python313Packages.xstatic-jquery-file-upload
- python314Packages.xstatic-jquery-file-upload
- python313Packages.tree-sitter-grammars.tree-sitter-jq
- python314Packages.tree-sitter-grammars.tree-sitter-jq
13 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse ignored
4 maintainers
- @ncfavier
- @7c6f434c
- @Artturin
- @06kellyjac
13 hours ago maintainer.ignore
@LeSuisse published on GitHub 13 hours ago

jq: potential integer overflow in jvp_string_append

https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx x_refsource_CONFIRM

jq

==< 1.8.2

Permalink CVE-2026-49839

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 21 hours ago
@LeSuisse ignored
35 packages
- ijq
- jql
- jqp
- njq
- gojq
- jqfmt
- jq-lsp
- jquake
- jq-zsh-plugin
- python312Packages.jq
- python313Packages.jq
- python314Packages.jq
- python312Packages.llm-jq
- python313Packages.llm-jq
- python314Packages.llm-jq
- haskellPackages.js-jquery
- python312Packages.xstatic-jquery
- python313Packages.xstatic-jquery
- python314Packages.xstatic-jquery
- python312Packages.django-jquery-js
- python313Packages.django-jquery-js
- python314Packages.django-jquery-js
- python312Packages.xstatic-jquery-ui
- python313Packages.xstatic-jquery-ui
- python314Packages.xstatic-jquery-ui
- tree-sitter-grammars.tree-sitter-jq
- vimPlugins.nvim-treesitter-parsers.jq
- python312Packages.sphinxcontrib-jquery
- python313Packages.sphinxcontrib-jquery
- python314Packages.sphinxcontrib-jquery
- python312Packages.xstatic-jquery-file-upload
- python313Packages.xstatic-jquery-file-upload
- python314Packages.xstatic-jquery-file-upload
- python313Packages.tree-sitter-grammars.tree-sitter-jq
- python314Packages.tree-sitter-grammars.tree-sitter-jq
13 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse ignored
4 maintainers
- @ncfavier
- @7c6f434c
- @06kellyjac
- @Artturin
13 hours ago maintainer.ignore
@LeSuisse published on GitHub 13 hours ago

jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow

https://github.com/jqlang/jq/security/advisories/GHSA-cfh2-vwfq-qfmm x_refsource_CONFIRMexploit

jq

==< 1.8.2

Nixpkgs security tracker

Published issues

Hydra - Stack Buffer Overflow in NTLM Authentication Handler

socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser

Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy

Halo: Path Traversal in Backup Download Leads to Arbitrary File Read

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

Nokogiri: Possible Use-After-Free in XInclude Processing

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

jq: stack overflow in deep structural equality

jq: potential integer overflow in jvp_string_append

jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow