NIXPKGS-2026-2433

GitHub issue published 15 hours ago

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Permalink CVE-2026-73501

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 20 hours ago
• @LeSuisse accepted 16 hours ago
• @LeSuisse published on GitHub 15 hours ago

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw x_refsource_CONFIRM
• https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da x_refsource_MISC
• https://github.com/getkin/kin-openapi/releases/tag/v0.144.0 x_refsource_MISC

---

kin-openapi

• ==< 0.144.0

NIXPKGS-2026-2432

GitHub issue published 15 hours ago

Incorrect Privilege Assignment in GitLab

Permalink CVE-2025-9486

3.3 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 20 hours ago
• @LeSuisse ignored
  40 packages

  • gitlab-art
  • gitlab-duo
  • gitlab-kas
  • gitlab-ci-ls
  • gitlab-pages
  • gitlab-shell
  • danger-gitlab
  • gitlab-clippy
  • gitlab-runner
  • gitlab-triage
  • gitlab-ci-local
  • gitlab-timelogs
  • gitlab-ci-linter
  • gitlab-workhorse
  • gitlab-ci-validate
  • gitlab-release-cli
  • ocamlPackages.gitlab
  • gitlab-container-registry
  • ocamlPackages.gitlab-jsoo
  • ocamlPackages.gitlab-unix
  • rubyPackages.gitlab-markup
  • terraform-providers.gitlab
  • ocamlPackages_latest.gitlab
  • gitlab-elasticsearch-indexer
  • haskellPackages.gitlab-haskell
  • rubyPackages_3_3.gitlab-markup
  • rubyPackages_3_4.gitlab-markup
  • rubyPackages_4_0.gitlab-markup
  • python313Packages.mkdocs-gitlab
  • python313Packages.python-gitlab
  • python314Packages.mkdocs-gitlab
  • python314Packages.python-gitlab
  • ocamlPackages_latest.gitlab-jsoo
  • ocamlPackages_latest.gitlab-unix
  • terraform-providers.gitlabhq_gitlab
  • gnomeExtensions.gitlab-time-tracking
  • prometheus-gitlab-ci-pipelines-exporter
  • vscode-extensions.gitlab.gitlab-workflow
  • perlPackages.AlienBuildPluginDownloadGitLab
  • perl5Packages.AlienBuildPluginDownloadGitLab
  16 hours ago
• @LeSuisse accepted 16 hours ago
• @LeSuisse published on GitHub 15 hours ago

Incorrect Privilege Assignment in GitLab

• GitLab Issue #565412 issue-trackingpermissions-required
• HackerOne Bug Bounty Report #3262844 exploittechnical-descriptionpermissions-required
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/

---

GitLab

• <19.1.4
• <19.2.2
• <19.0.6

NIXPKGS-2026-2431

GitHub issue published 15 hours ago

Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source …

Permalink CVE-2026-19588

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 20 hours ago
• @LeSuisse ignored package libsForQt5.rlottie-qml 16 hours ago
• @LeSuisse accepted 16 hours ago
• @LeSuisse published on GitHub 15 hours ago

Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source …

• https://github.com/Samsung/rlottie/pull/600

---

rlottie

• ==8117b9ee595763f35c0da2c07181203959f0c510

NIXPKGS-2026-2430

GitHub issue published 15 hours ago

regclient may leak authentication credentials to external blob stores

Permalink CVE-2026-49349

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 20 hours ago
• @LeSuisse ignored
  3 packages

  • regsync
  • regctl
  • regbot
  16 hours ago
• @LeSuisse accepted 16 hours ago
• @LeSuisse published on GitHub 15 hours ago

regclient may leak authentication credentials to external blob stores

• https://github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp x_refsource_CONFIRM

---

regclient

• ==< 0.11.5

Needs backport

NIXPKGS-2026-2429

GitHub issue published 15 hours ago

tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

Permalink CVE-2026-9318

4.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 20 hours ago
• @LeSuisse accepted 16 hours ago
• @LeSuisse published on GitHub 15 hours ago

tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

• Product Repository product
• Pull Request issue-tracking
• Patch Release patch
• https://www.vulncheck.com/advisories/tablib-versions-prior-to-stored-xss-via-ht… third-party-advisory

---

tablib

• <3.10.0

NIXPKGS-2026-2428

GitHub issue published 15 hours ago

RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

Permalink CVE-2026-73288

6.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 20 hours ago
• @LeSuisse accepted 16 hours ago
• @LeSuisse published on GitHub 15 hours ago

RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

• https://github.com/rustfs/rustfs/security/advisories/GHSA-j548-9grx-fh4f x_refsource_CONFIRM
• https://github.com/rustfs/rustfs/pull/5648 x_refsource_MISC
• https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d x_refsource_MISC
• https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1 x_refsource_MISC

---

rustfs

• ==< 1.0.0-rc.1

NIXPKGS-2026-2427

GitHub issue published 15 hours ago

Material for MkDocs: DOM XSS in search suggestions via query parameter

Permalink CVE-2026-73295

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 20 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.mkdocs-material-extensions
  • python314Packages.mkdocs-material-extensions
  16 hours ago
• @LeSuisse accepted 16 hours ago
• @LeSuisse published on GitHub 15 hours ago

Material for MkDocs: DOM XSS in search suggestions via query parameter

• https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf x_refsource_CONFIRM
• https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25 x_refsource_MISC
• https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7 x_refsource_MISC

---

mkdocs-material

• ==>= 7.2.0, < 9.7.7

NIXPKGS-2026-2426

GitHub issue published 15 hours ago

Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows …

Permalink CVE-2026-19587

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 20 hours ago
• @LeSuisse ignored package libsForQt5.rlottie-qml 16 hours ago
• @LeSuisse accepted 16 hours ago
• @LeSuisse published on GitHub 15 hours ago

Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows …

• https://github.com/Samsung/rlottie/pull/599

---

rlottie

• ==87e166c0a72b6f3110083dd6de0e47dcb9e1c2b5

NIXPKGS-2026-2425

GitHub issue published 15 hours ago

jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

Permalink CVE-2026-73415

7.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 20 hours ago
• @LeSuisse ignored
  16 packages

  • python313Packages.jupyterlab-git
  • python313Packages.jupyterlab-lsp
  • python313Packages.jupyterlab-vim
  • python314Packages.jupyterlab-git
  • python314Packages.jupyterlab-lsp
  • python314Packages.jupyterlab-vim
  • python313Packages.jupyterlab-server
  • python314Packages.jupyterlab-server
  • python313Packages.jupyterlab-widgets
  • python314Packages.jupyterlab-widgets
  • python313Packages.jupyterlab-git-core
  • python313Packages.jupyterlab-pygments
  • python314Packages.jupyterlab-git-core
  • python314Packages.jupyterlab-pygments
  • python313Packages.jupyterlab-execute-time
  • python314Packages.jupyterlab-execute-time
  16 hours ago
• @LeSuisse accepted 16 hours ago
• @LeSuisse published on GitHub 15 hours ago

jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c x_refsource_CONFIRM
• https://github.com/jupyterlab/jupyterlab/pull/19184 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/pull/19185 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/pull/19186 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1 x_refsource_MISC

---

jupyterlab

• ==< 4.5.10
• ==>= 4.6.0, < 4.6.2

NIXPKGS-2026-2424

GitHub issue published 15 hours ago

Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

Permalink CVE-2026-73291

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 15 hours ago by @LeSuisse Activity log

• Created suggestion 20 hours ago
• @LeSuisse ignored
  4 packages

  • overseerr
  • jellyseerr
  • python313Packages.python-overseerr
  • python314Packages.python-overseerr
  16 hours ago
• @LeSuisse accepted 16 hours ago
• @LeSuisse published on GitHub 15 hours ago

Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

• https://github.com/seerr-team/seerr/security/advisories/GHSA-mc6w-69r3-62h8 x_refsource_CONFIRM
• https://github.com/seerr-team/seerr/commit/f484791105bd81bd5404e01410431ee6fe5769c2 x_refsource_MISC
• https://github.com/seerr-team/seerr/releases/tag/v3.4.0 x_refsource_MISC

---

seerr

• ==< 3.4.0

Backport needed