NIXPKGS-2026-2333

GitHub issue published 9 hours ago

Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Permalink CVE-2026-25552

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 16 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

• GitHub Security Advisory (GHSA-wjx2-9fpq-8997)
• https://www.vulncheck.com/advisories/ghost-cli-ip-spoofing-via-x-forwarded-for-… third-party-advisory

---

Ghost-CLI

• <1.30.1

NIXPKGS-2026-2332

GitHub issue published 9 hours ago

sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

Permalink CVE-2026-68770

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 16 hours ago
• @LeSuisse ignored
  3 packages

  • python313Packages.llm-sentence-transformers
  • python314Packages.llm-sentence-transformers
  • pkgsRocm.python3Packages.llm-sentence-transformers
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse ignored reference Product R… 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

• GitHub Issue issue-tracking
• Pull Request vendor-advisory
• Patch Commit patch
• https://www.vulncheck.com/advisories/sentence-transformers-arbitrary-code-execu… third-party-advisory

Ignored references (1)

• Product Repository product

---

sentence-transformers

• =<5.5.1

NIXPKGS-2026-2331

GitHub issue published 9 hours ago

coturn: security issues < 4.15.0

Permalink CVE-2026-62959

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 16 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)

• https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g exploitx_refsource_CONFIRM
• https://github.com/coturn/coturn/pull/1965 x_refsource_MISC
• https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4 x_refsource_MISC
• https://github.com/coturn/coturn/releases/tag/4.15.0 x_refsource_MISC

---

coturn

• ==>= 4.5.2, < 4.15.0

Permalink CVE-2026-65981

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 16 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover

• https://github.com/coturn/coturn/security/advisories/GHSA-69wx-x7x6-pjj8 x_refsource_CONFIRM
• https://github.com/coturn/coturn/commit/37df0513168f830a7c9ce0a411db0300fa182f05 x_refsource_MISC

---

coturn

• ==< 4.15.0

NIXPKGS-2026-2330

GitHub issue published 1 day, 7 hours ago

python3Packages.banks: security issues < 2.4.4

Permalink CVE-2026-62663

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse ignored
  5 packages

  • bankstown-lv2
  • nltk-data.universal-treebanks-v20
  • python313Packages.asteroid-filterbanks
  • python314Packages.asteroid-filterbanks
  • pkgsRocm.python3Packages.asteroid-filterbanks
  1 day, 7 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document)

• https://github.com/masci/banks/security/advisories/GHSA-98rr-gvc9-3cjh exploitx_refsource_CONFIRM

---

banks

• ==< 2.4.4

Needs backports 26.05

Permalink CVE-2026-61536

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse ignored
  5 packages

  • bankstown-lv2
  • nltk-data.universal-treebanks-v20
  • python313Packages.asteroid-filterbanks
  • python314Packages.asteroid-filterbanks
  • pkgsRocm.python3Packages.asteroid-filterbanks
  1 day, 7 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

• https://github.com/masci/banks/security/advisories/GHSA-64vx-6h2c-rjh7 x_refsource_CONFIRM

---

banks

• ==< 2.4.3

Needs backports 26.05

NIXPKGS-2026-2329

GitHub issue published 1 day, 7 hours ago

RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

Permalink CVE-2026-64816

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse accepted 1 day, 8 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

• Release Notes release-notes
• Patch Commit patch
• https://www.vulncheck.com/advisories/rapidraw-ntlmv2-credential-leak-via-unc-pa… third-party-advisory

---

RapidRAW

• <1.6.0

NIXPKGS-2026-2328

GitHub issue published 1 day, 7 hours ago

VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection

Permalink CVE-2026-54249

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 16 hours ago
• @LeSuisse accepted 1 day, 22 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection

• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h7p7-w5gc-xj3w x_refsource_CONFIRM

---

pydantic-ai

• ==>= 2.0.0b1, < 2.0.0b6
• ==>= 1.65.0, < 1.106.0

pydantic-ai-slim

• ==>= 2.0.0b1, < 2.0.0b6
• ==>= 1.65.0, < 1.106.0

NIXPKGS-2026-2327

GitHub issue published 1 day, 7 hours ago

perlPackages.DateManip: security issues <= 6.99

Permalink CVE-2026-60075

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse accepted 1 day, 8 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time

• https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch patch
• https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.p…
• https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.p…
• http://www.openwall.com/lists/oss-security/2026/07/30/20

---

Date-Manip

• =<6.99

Permalink CVE-2026-60074

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check

• https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60074-r1.patch patch
• https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Base.p…
• https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.p…
• http://www.openwall.com/lists/oss-security/2026/07/30/19

---

Date-Manip

• =<6.99

NIXPKGS-2026-2326

GitHub issue published 1 day, 7 hours ago

lib60870: security issues < 2.4.1

Permalink CVE-2026-63033

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse accepted 1 day, 8 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

MZ Automation lib60870 Out-of-bounds Read

• https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5…
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

lib60870

• ==2.4.0
• ==2.4.1

Permalink CVE-2026-61893

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

MZ Automation lib60870 Out-of-bounds Read

• https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83…
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

lib60870

• ==2.4.0
• ==2.4.1

NIXPKGS-2026-2325

GitHub issue published 1 day, 7 hours ago

SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

Permalink CVE-2026-10031

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse ignored package sftpgo-plugin-auth 1 day, 7 hours ago
• @LeSuisse ignored reference Product R… 1 day, 7 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

• https://github.com/drakkan/sftpgo/security/advisories/GHSA-fj9v-mxr3-w75w vendor-advisory
• Patch Commit patch
• https://www.vulncheck.com/advisories/sftpgo-permission-bypass-via-symbolic-link… third-party-advisory

Ignored references (1)

• Product Repository product

---

SFTPGo

• <2.7.4

Needs backports to 26.05

NIXPKGS-2026-2324

GitHub issue published 1 day, 7 hours ago

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Permalink CVE-2026-66066

9.5 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 16 hours ago
• @LeSuisse ignored
  10 packages

  • rails-new
  • grails
  • rubyPackages_4_0.rails-html-sanitizer
  • rubyPackages_3_4.rails-html-sanitizer
  • rubyPackages_4_0.rails-dom-testing
  • rubyPackages_3_4.rails-dom-testing
  • rubyPackages_3_3.rails-dom-testing
  • rubyPackages.rails-html-sanitizer
  • rubyPackages.rails-dom-testing
  • rubyPackages_3_3.rails-html-sanitizer
  1 day, 7 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

• https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm x_refsource_CONFIRM
• https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e x_refsource_MISC
• https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5 x_refsource_MISC
• https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a x_refsource_MISC
• https://github.com/rails/rails/releases/tag/v7.2.3.2 x_refsource_MISC
• https://github.com/rails/rails/releases/tag/v8.0.5.1 x_refsource_MISC
• https://github.com/rails/rails/releases/tag/v8.1.3.1 x_refsource_MISC
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml x_refsource_MISC
• https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html x_refsource_MISC
• http://www.openwall.com/lists/oss-security/2026/07/29/9

---

rails

• ==< 7.2.3.2
• ==>= 8.0.0.beta1, < 8.0.5.1
• ==>= 8.1.0.beta1, < 8.1.3.1