NIXPKGS-2026-2351

GitHub issue published 13 hours ago

pdm: security issues < 2.27.0 (needs a backport)

Permalink CVE-2026-47764

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 1 day ago
• @LeSuisse ignored
  6 packages

  • python313Packages.pdm-pep517
  • python314Packages.pdm-pep517
  • python313Packages.pdm-backend
  • python314Packages.pdm-backend
  • python313Packages.pdm-build-locked
  • python314Packages.pdm-build-locked
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

pdm: Path traversal in wheel installation via overridden write_to_fs

• https://github.com/pdm-project/pdm/security/advisories/GHSA-78v8-vpjp-cjqh x_refsource_CONFIRM
• https://github.com/pdm-project/pdm/releases/tag/2.27.0 x_refsource_MISC

---

pdm

• ==< 2.27.0

Needs a backport

Permalink CVE-2026-47781

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 1 day ago
• @LeSuisse ignored
  6 packages

  • python313Packages.pdm-pep517
  • python314Packages.pdm-pep517
  • python313Packages.pdm-backend
  • python314Packages.pdm-backend
  • python313Packages.pdm-build-locked
  • python314Packages.pdm-build-locked
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

• https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf x_refsource_CONFIRM
• https://github.com/pdm-project/pdm/releases/tag/2.27.0 x_refsource_MISC

---

pdm

• ==< 2.27.0

Needs a backport

Permalink CVE-2026-47763

6.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 1 day ago
• @LeSuisse ignored
  6 packages

  • python313Packages.pdm-pep517
  • python314Packages.pdm-pep517
  • python313Packages.pdm-backend
  • python314Packages.pdm-backend
  • python313Packages.pdm-build-locked
  • python314Packages.pdm-build-locked
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

pdm: Project-Local State and Config Writes Follow Symlinks

• https://github.com/pdm-project/pdm/security/advisories/GHSA-ghq2-5c67-fprm x_refsource_CONFIRM
• https://github.com/pdm-project/pdm/releases/tag/2.27.0 x_refsource_MISC

---

pdm

• ==< 2.27.0

Needs a backport

NIXPKGS-2026-2350

GitHub issue published 13 hours ago

marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

Permalink CVE-2026-67618

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 1 day ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

• Release Notes release-notes
• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/marimo-api-key-exfiltration-via-malicious-… third-party-advisory

---

marimo

• <0.23.15

NIXPKGS-2026-2349

GitHub issue published 13 hours ago

Improper input validation vulnerability in Samsung Open Source rlottie allows …

Permalink CVE-2026-18772

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 1 day ago
• @LeSuisse ignored package libsForQt5.rlottie-qml 13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

Improper input validation vulnerability in Samsung Open Source rlottie allows …

• https://github.com/Samsung/rlottie/pull/596

---

rlottie

• ==f487eff2f8086b84ae1c7faa0418abec909e874b

NIXPKGS-2026-2348

GitHub issue published 13 hours ago

Popt-devel: popt-static: off-by-one in poptstuffargs

Permalink CVE-2026-18739

2.5 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 1 day ago
• @LeSuisse ignored
  12 packages

  • ipopt
  • poptop
  • poptracker
  • scipopt-ug
  • scipopt-gcg
  • scipopt-scip
  • scipopt-zimpl
  • scipopt-papilo
  • scipopt-soplex
  • pkgsRocm.scipopt-ug
  • python313Packages.cyipopt
  • python314Packages.cyipopt
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

Popt-devel: popt-static: off-by-one in poptstuffargs

• https://access.redhat.com/security/cve/CVE-2026-18739 x_refsource_REDHATvdb-entry
• RHBZ#2510737 issue-trackingx_refsource_REDHAT

---

popt

rhcos

Apparently no published fix yet (2026-08-05)

NIXPKGS-2026-2347

GitHub issue published 1 day, 16 hours ago

Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr

Permalink CVE-2026-68742

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 day, 16 hours ago by @LeSuisse Activity log

• Created suggestion 2 days ago
• @LeSuisse ignored
  2 packages

  • python313Packages.aliyun-python-sdk-osssddp
  • python314Packages.aliyun-python-sdk-osssddp
  1 day, 16 hours ago
• @LeSuisse accepted 1 day, 16 hours ago
• @LeSuisse published on GitHub 1 day, 16 hours ago

Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr

• https://access.redhat.com/security/cve/CVE-2026-68742 x_refsource_REDHATvdb-entry
• RHBZ#2509762 issue-trackingx_refsource_REDHAT

---

sssd

rhcos

NIXPKGS-2026-2346

GitHub issue published 1 day, 16 hours ago

PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Permalink CVE-2026-69153

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 16 hours ago by @LeSuisse Activity log

• Created suggestion 2 days ago
• @LeSuisse accepted 1 day, 16 hours ago
• @LeSuisse published on GitHub 1 day, 16 hours ago

PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

• https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp exploitx_refsource_CONFIRM
• https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8 x_refsource_MISC
• https://github.com/postcss/postcss/releases/tag/8.5.19 x_refsource_MISC

---

postcss

• ==< 8.5.19

NIXPKGS-2026-2345

GitHub issue published 1 day, 16 hours ago

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

Permalink CVE-2026-48061

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 day, 16 hours ago by @LeSuisse Activity log

• Created suggestion 2 days ago
• @LeSuisse ignored
  2 packages

  • python313Packages.litestar-htmx
  • python314Packages.litestar-htmx
  1 day, 16 hours ago
• @LeSuisse accepted 1 day, 16 hours ago
• @LeSuisse published on GitHub 1 day, 16 hours ago

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

• https://github.com/litestar-org/litestar/security/advisories/GHSA-3qmc-cj7q-62hv x_refsource_CONFIRM
• https://github.com/litestar-org/litestar/commit/6930a20ceb543912cd651b42deae5b9f3637a262 x_refsource_MISC

---

litestar

• ==< 2.22.0

NIXPKGS-2026-2344

GitHub issue published 1 day, 16 hours ago

GitPython before 3.1.53 Config Injection via Submodule Names

Permalink CVE-2026-69097

7.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 16 hours ago by @LeSuisse Activity log

• Created suggestion 2 days ago
• @LeSuisse accepted 1 day, 16 hours ago
• @LeSuisse published on GitHub 1 day, 16 hours ago

GitPython before 3.1.53 Config Injection via Submodule Names

• GitHub Security Advisory (GHSA-3rp5-jjmw-4wv2) vendor-advisoryexploit
• VulnCheck Advisory: GitPython before 3.1.53 Config Injection via Submodule Names third-party-advisory

---

GitPython

• <3.1.53
• ==3.1.53

NIXPKGS-2026-2343

GitHub issue published 1 day, 16 hours ago

python3Packages.cryptography: security issues < 49.0.0 (backport needed)

Permalink CVE-2026-69248

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 day, 16 hours ago by @LeSuisse Activity log

• Created suggestion 2 days ago
• @LeSuisse ignored
  8 packages

  • python313Packages.mypy-boto3-payment-cryptography
  • python314Packages.mypy-boto3-payment-cryptography
  • python313Packages.mypy-boto3-payment-cryptography-data
  • python314Packages.mypy-boto3-payment-cryptography-data
  • python313Packages.types-aiobotocore-payment-cryptography
  • python314Packages.types-aiobotocore-payment-cryptography
  • python313Packages.types-aiobotocore-payment-cryptography-data
  • python314Packages.types-aiobotocore-payment-cryptography-data
  1 day, 16 hours ago
• @LeSuisse accepted 1 day, 16 hours ago
• @LeSuisse published on GitHub 1 day, 16 hours ago

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

• https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c x_refsource_CONFIRM
• https://github.com/pyca/cryptography/pull/14888 x_refsource_MISC
• https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2 x_refsource_MISC

---

cryptography

• ==< 49.0.0

Permalink CVE-2026-69249

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 16 hours ago by @LeSuisse Activity log

• Created suggestion 2 days ago
• @LeSuisse ignored
  8 packages

  • python313Packages.mypy-boto3-payment-cryptography
  • python314Packages.mypy-boto3-payment-cryptography
  • python313Packages.mypy-boto3-payment-cryptography-data
  • python314Packages.mypy-boto3-payment-cryptography-data
  • python313Packages.types-aiobotocore-payment-cryptography
  • python314Packages.types-aiobotocore-payment-cryptography
  • python313Packages.types-aiobotocore-payment-cryptography-data
  • python314Packages.types-aiobotocore-payment-cryptography-data
  1 day, 16 hours ago
• @LeSuisse accepted 1 day, 16 hours ago
• @LeSuisse published on GitHub 1 day, 16 hours ago

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

• https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww x_refsource_CONFIRM
• https://github.com/pyca/cryptography/pull/14960 x_refsource_MISC
• https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582 x_refsource_MISC

---

cryptography

• ==< 49.0.0

Permalink CVE-2026-69247

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 16 hours ago by @LeSuisse Activity log

• Created suggestion 2 days ago
• @LeSuisse ignored
  8 packages

  • python313Packages.mypy-boto3-payment-cryptography
  • python314Packages.mypy-boto3-payment-cryptography
  • python313Packages.mypy-boto3-payment-cryptography-data
  • python314Packages.mypy-boto3-payment-cryptography-data
  • python313Packages.types-aiobotocore-payment-cryptography
  • python314Packages.types-aiobotocore-payment-cryptography
  • python313Packages.types-aiobotocore-payment-cryptography-data
  • python314Packages.types-aiobotocore-payment-cryptography-data
  1 day, 16 hours ago
• @LeSuisse accepted 1 day, 16 hours ago
• @LeSuisse published on GitHub 1 day, 16 hours ago

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

• https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5 x_refsource_CONFIRM
• https://github.com/pyca/cryptography/pull/15369 x_refsource_MISC
• https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f x_refsource_MISC

---

cryptography

• ==>= 44.0.0, < 50.0.0

NIXPKGS-2026-2342

GitHub issue published 2 days, 14 hours ago

PyAthena 3.35.4 SQL Injection via DefaultParameterFormatter DELETE/CTAS

Permalink CVE-2026-65321

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 14 hours ago by @LeSuisse Activity log

• Created suggestion 3 days ago
• @LeSuisse accepted 2 days, 14 hours ago
• @LeSuisse published on GitHub 2 days, 14 hours ago

PyAthena 3.35.4 SQL Injection via DefaultParameterFormatter DELETE/CTAS

• Product Repository product
• GitHub Security Advisory vendor-advisory
• Patch Commit patch
• https://www.vulncheck.com/advisories/pyathena-sql-injection-via-defaultparamete… third-party-advisory

---

PyAthena

• =<3.35.3