NIXPKGS-2026-2614

GitHub issue published 11 hours ago

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Permalink CVE-2026-19773

9.8 CRITICAL

• CVSS version (CVSS): 3.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

• ZDI-26-590 x_research-advisory
• vendor-provided URL vendor-advisory

---

libwebsockets

• ==b4b5aed3903eaff09cd76a410f69bbe5dff66f8e

NIXPKGS-2026-2613

GitHub issue published 11 hours ago

Nextflow: Incorrect default permissions in the nextflow auth login command

Permalink CVE-2026-48722

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

Nextflow: Incorrect default permissions in the nextflow auth login command

• https://github.com/nextflow-io/nextflow/security/advisories/GHSA-92qf-fcph-v5wr x_refsource_CONFIRM
• https://github.com/nextflow-io/nextflow/pull/7182 x_refsource_MISC
• https://github.com/nextflow-io/nextflow/commit/41a5f24afec8a6e9769a24cae5e08b5462fbfdc1 x_refsource_MISC
• https://github.com/nextflow-io/nextflow/commit/a2813c610a3e7f13d7a0a0b1b543b7ad47586eaa x_refsource_MISC
• https://github.com/nextflow-io/nextflow/releases/tag/v25.10.6 x_refsource_MISC
• https://github.com/nextflow-io/nextflow/releases/tag/v26.04.3 x_refsource_MISC

---

nextflow

• ==>= 25.09.2-edge, < 25.10.6
• ==>= 25.11.0-edge, < 26.04.3

Needs something for 26.05.

NIXPKGS-2026-2612

GitHub issue published 11 hours ago

pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint

Permalink CVE-2026-91924

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint

• GitHub Issue #869 issue-tracking
• https://github.com/sosedoff/pgweb product
• routes.go - /api/connect registered unconditionally alongside the backend-gated route technical-description
• api.go - Connect falls through to ConnectWithURL with no connect-backend check technical-description
• VulnCheck Advisory: pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint third-party-advisory

---

pgweb

• =<0.17.0

NIXPKGS-2026-2611

GitHub issue published 11 hours ago

Governikus AusweisApp StartPAOSResponse cross site scripting

Permalink CVE-2026-90848

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): Not Defined (X)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

Governikus AusweisApp StartPAOSResponse cross site scripting

• VDB-403403 | Governikus AusweisApp StartPAOSResponse cross site scripting technical-descriptionvdb-entry
• VDB-403403 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• CVE-2026-90848 | CVE Analysis and Report third-party-advisory
• Submit #925923 | Governikus GmbH & Co. KG AusweisApp (Desktop) 2.5.4 Cross Site Scripting third-party-advisory
• https://www.Governikus.de/loesungen/kundenprojekte/AusweisApp/ patch

---

AusweisApp

• ==2.5.3
• ==2.5.2
• ==2.5.0
• ==2.5.5
• ==2.5.1
• ==2.5.4

NIXPKGS-2026-2610

GitHub issue published 11 hours ago

Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter

Permalink CVE-2026-91772

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored reference https://g… 11 hours ago
• @LeSuisse ignored
  11 packages

  • eschalot
  • python313Packages.halo
  • python314Packages.halo
  • typstPackages.whalogen
  • python313Packages.halohome
  • python314Packages.halohome
  • typstPackages.whalogen_0_1_0
  • typstPackages.whalogen_0_2_0
  • typstPackages.whalogen_0_3_0
  • python313Packages.django-cachalot
  • python314Packages.django-cachalot
  11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter

• https://github.com/halo-dev/halo/issues/10247 issue-tracking
• https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/java/run/hal… technical-description
• https://github.com/halo-dev/halo/blob/v2.26.1/application/src/main/resources/ex… technical-description
• VulnCheck Advisory: Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter third-party-advisory

Ignored references (1)

• https://github.com/halo-dev/halo product

---

halo

• =<2.26.1

NIXPKGS-2026-2609

GitHub issue published 11 hours ago

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

Permalink CVE-2026-39919

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  3 packages

  • python313Packages.ghostscript
  • python314Packages.ghostscript
  • haskellPackages.ghostscript-parallel
  11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

• Release Tag release-notes
• Patch Commit patch
• Bugzilla Report issue-tracking
• https://www.vulncheck.com/advisories/ghostscript-heap-buffer-overflow-via-jpeg-… third-party-advisory

---

Ghostscript

• <10.08.0

NIXPKGS-2026-2608

GitHub issue published 11 hours ago

gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

Permalink CVE-2026-91986

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

• GitHub Security Advisory (GHSA-rc7h-wp5f-w3g5) vendor-advisory
• VulnCheck Advisory: gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection third-party-advisory

---

gitoxide

• <0.59.2
• ==0.59.2

NIXPKGS-2026-2607

GitHub issue published 11 hours ago

BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion

Permalink CVE-2026-89022

9.1 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion

• Vendor Advisory vendor-advisory
• https://www.vulncheck.com/advisories/bookstack-authentication-bypass-via-social… third-party-advisory

---

bookstack

• <26.05.5

NIXPKGS-2026-2606

GitHub issue published 11 hours ago

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

Permalink CVE-2026-52724

5.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  16 packages

  • kuma
  • kuma-cp
  • kumactl
  • autokuma
  • uptime-kuma
  • kuma-experimental
  • python313Packages.apykuma
  • python314Packages.apykuma
  • python313Packages.pythonkuma
  • python314Packages.pythonkuma
  • python313Packages.uptime-kuma-api
  • python314Packages.uptime-kuma-api
  • gnomeExtensions.uptime-kuma-indicator
  • python313Packages.uptime-kuma-monitor
  • python314Packages.uptime-kuma-monitor
  • vscode-extensions.tekumara.typos-vscode
  11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv x_refsource_CONFIRM
• https://github.com/kumahq/kuma/pull/16777 x_refsource_MISC
• https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f x_refsource_MISC
• https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870 x_refsource_MISC
• https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3 x_refsource_MISC
• https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569 x_refsource_MISC
• https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980 x_refsource_MISC
• https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11 x_refsource_MISC

---

kuma

• ==>= 2.13.0, < 2.13.7
• ==>= 2.12.0, < 2.12.11
• ==>= 2.8.0, < 2.9.16
• ==< 2.7.26
• ==>= 2.10.0, < 2.11.14

NIXPKGS-2026-2605

GitHub issue published 11 hours ago

Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers …

Permalink CVE-2026-91826

4.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored package libsForQt5.rlottie-qml 11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers …

• https://github.com/Samsung/rlottie/pull/607

---

rLottie

• ==480a2ad0c5d2e45458c545b8213279e9e8b71e39