NIXPKGS-2026-2371

GitHub issue published 1 day, 2 hours ago

Mermaid radar diagrams are vulnerable to DoS

Permalink CVE-2026-71439

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored
  11 packages

  • mdbook-mermaid
  • mermaid-filter
  • python313Packages.sphinxcontrib-mermaid
  • python314Packages.sphinxcontrib-mermaid
  • python313Packages.mkdocs-mermaid2-plugin
  • python314Packages.mkdocs-mermaid2-plugin
  • tree-sitter-grammars.tree-sitter-mermaid
  • vimPlugins.nvim-treesitter-parsers.mermaid
  • vscode-extensions.bierner.markdown-mermaid
  • python313Packages.tree-sitter-grammars.tree-sitter-mermaid
  • python314Packages.tree-sitter-grammars.tree-sitter-mermaid
  1 day, 2 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

Mermaid radar diagrams are vulnerable to DoS

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh x_refsource_CONFIRM
• https://github.com/mermaid-js/mermaid/pull/8022 x_refsource_MISC
• https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e x_refsource_MISC
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 x_refsource_MISC

---

mermaid

• ==>= 11.6.0, < 11.16.1

NIXPKGS-2026-2370

GitHub issue published 1 day, 2 hours ago

Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter

Permalink CVE-2026-63637

8.6 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored
  3 packages

  • coqPackages.dpdgraph
  • perlPackages.GDGraph
  • perl5Packages.GDGraph
  1 day, 2 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter

• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-33p8-wc97-5qcj x_refsource_CONFIRM
• https://github.com/dgraph-io/dgraph/commit/aaff09ab9608f87d88e9d601e71d271306083392 x_refsource_MISC

---

dgraph

• ==< 25.3.8

NIXPKGS-2026-2369

GitHub issue published 1 day, 2 hours ago

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Permalink CVE-2026-61632

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-9xwg-3r6f-jcx2 x_refsource_CONFIRM
• https://github.com/facelessuser/pymdown-extensions/releases/tag/11.0 x_refsource_MISC

---

pymdown-extensions

• ==< 11.0

NIXPKGS-2026-2368

GitHub issue published 1 day, 2 hours ago

Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()

Permalink CVE-2026-18487

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()

• https://access.redhat.com/security/cve/CVE-2026-18487 x_refsource_REDHATvdb-entry
• RHBZ#2509570 x_refsource_REDHATissue-tracking
• https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433…
• https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897

---

epiphany

• *

NIXPKGS-2026-2367

GitHub issue published 1 day, 2 hours ago

pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

Permalink CVE-2026-67422

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw x_refsource_CONFIRM
• https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b x_refsource_MISC

---

pymdown-extensions

• ==< 11.0.1

NIXPKGS-2026-2366

GitHub issue published 1 day, 2 hours ago

aprutil: security issues < 1.6.4

Permalink CVE-2025-49506

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

• https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5 vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/08/06/8

---

APR-util

• =<1.6.3

Permalink CVE-2026-32327

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

Apache Portable Runtime Utility: apr-util XML stack recursion crash

• https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1 vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/08/06/9

---

APR-util

• =<1.6.3

NIXPKGS-2026-2365

GitHub issue published 1 day, 2 hours ago

traefik: security issues < 3.7.10

Permalink CVE-2026-71326

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored package traefik-certs-dumper 1 day, 2 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing

• https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf x_refsource_CONFIRM
• https://github.com/traefik/traefik/pull/13572 x_refsource_MISC
• https://github.com/traefik/traefik/commit/b5ace8eb5d6779980567f5e75efd2d9e08b7e350 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.6.25 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.7.10 x_refsource_MISC

---

traefik

• ==>= 3.7.0, < 3.7.10
• ==>= 3.6.11, < 3.6.25

Permalink CVE-2026-71325

4.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored package traefik-certs-dumper 1 day, 2 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef

• https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq x_refsource_CONFIRM
• https://github.com/traefik/traefik/commit/65ebf4b47fbdc33e3856803a5844a404e094d52d x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v2.11.54 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.6.25 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.7.10 x_refsource_MISC

---

traefik

• ==>= 3.0.0, < 3.6.25
• ==>= 3.7.0, < 3.7.10
• ==< 2.11.54

Permalink CVE-2026-71324

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored package traefik-certs-dumper 1 day, 2 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

• https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6 x_refsource_CONFIRM
• https://github.com/traefik/traefik/pull/13542 x_refsource_MISC
• https://github.com/traefik/traefik/pull/13543 x_refsource_MISC
• https://github.com/traefik/traefik/pull/13556 x_refsource_MISC
• https://github.com/traefik/traefik/commit/04d36f28e4eae7535e96a6351dd9f7bfb48a30e7 x_refsource_MISC
• https://github.com/traefik/traefik/commit/0807b6d5dd1da8b2f7f4076ea2392b5437bf2ab0 x_refsource_MISC
• https://github.com/traefik/traefik/commit/94a7508817d180f0ab2f1eae93df48d4ab19ecce x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v2.11.53 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.6.24 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.7.9 x_refsource_MISC

---

traefik

• ==< 2.11.53
• ==>= 3.7.0, < 3.7.9
• ==>= 3.0.0, < 3.6.24

Permalink CVE-2026-71327

7.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored package traefik-certs-dumper 1 day, 2 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

• https://github.com/traefik/traefik/security/advisories/GHSA-fgjj-px3w-67xx x_refsource_CONFIRM
• https://github.com/traefik/traefik/pull/13580 x_refsource_MISC
• https://github.com/traefik/traefik/commit/a764166656f0cd337f917ac76315c381cca844f9 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.6.25 x_refsource_MISC
• https://github.com/traefik/traefik/releases/tag/v3.7.10 x_refsource_MISC

---

traefik

• ==>= 3.0.0, < 3.6.25
• ==>= 3.7.0, < 3.7.10

NIXPKGS-2026-2364

GitHub issue published 1 day, 2 hours ago

postgresqlPackages.timescaledb: security issues <= 2.29.1

Permalink CVE-2026-70633

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored
  12 packages

  • timescaledb-parallel-copy
  • timescaledb-tune
  • postgresqlPackages.timescaledb-apache
  • postgresqlPackages.timescaledb_toolkit
  • postgresql15Packages.timescaledb-apache
  • postgresql16Packages.timescaledb-apache
  • postgresql17Packages.timescaledb-apache
  • postgresql18Packages.timescaledb-apache
  • postgresql15Packages.timescaledb_toolkit
  • postgresql16Packages.timescaledb_toolkit
  • postgresql17Packages.timescaledb_toolkit
  • postgresql18Packages.timescaledb_toolkit
  1 day, 2 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Gorilla Compression Reverse Iterator

• Pull Request issue-tracking
• Patch Commit patch

---

timescaledb

• ==517c13e7cc6afadb4a7deaa7a5a5a29065e5b5a3
• =<2.29.1

Permalink CVE-2026-70634

7.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored
  12 packages

  • timescaledb-tune
  • timescaledb-parallel-copy
  • postgresqlPackages.timescaledb-apache
  • postgresqlPackages.timescaledb_toolkit
  • postgresql15Packages.timescaledb-apache
  • postgresql16Packages.timescaledb-apache
  • postgresql17Packages.timescaledb-apache
  • postgresql18Packages.timescaledb-apache
  • postgresql15Packages.timescaledb_toolkit
  • postgresql16Packages.timescaledb_toolkit
  • postgresql17Packages.timescaledb_toolkit
  • postgresql18Packages.timescaledb_toolkit
  1 day, 2 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

TimescaleDB 2.29.1 Out-of-Bounds Read Information Disclosure via Dictionary Compression Reverse Iterator

• Pull Request issue-tracking
• Patch Commit patch

---

timescaledb

• =<2.29.1
• ==517c13e7cc6afadb4a7deaa7a5a5a29065e5b5a3

Permalink CVE-2026-70635

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 2 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored
  12 packages

  • timescaledb-tune
  • timescaledb-parallel-copy
  • postgresqlPackages.timescaledb-apache
  • postgresqlPackages.timescaledb_toolkit
  • postgresql15Packages.timescaledb-apache
  • postgresql16Packages.timescaledb-apache
  • postgresql17Packages.timescaledb-apache
  • postgresql18Packages.timescaledb-apache
  • postgresql15Packages.timescaledb_toolkit
  • postgresql16Packages.timescaledb_toolkit
  • postgresql17Packages.timescaledb_toolkit
  • postgresql18Packages.timescaledb_toolkit
  1 day, 2 hours ago
• @LeSuisse accepted 1 day, 2 hours ago
• @LeSuisse published on GitHub 1 day, 2 hours ago

TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative Index

• Pull Request issue-tracking
• Patch Commit patch

---

timescaledb

• =<2.29.1
• ==517c13e7cc6afadb4a7deaa7a5a5a29065e5b5a3

NIXPKGS-2026-2363

GitHub issue published 2 days, 10 hours ago

ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

Permalink CVE-2026-71260

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 days, 10 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse ignored
  8 packages

  • python313Packages.aioesphomeapi
  • python313Packages.bleak-esphome
  • python314Packages.aioesphomeapi
  • python314Packages.bleak-esphome
  • python313Packages.esphome-glyphsets
  • python314Packages.esphome-glyphsets
  • python313Packages.esphome-dashboard-api
  • python314Packages.esphome-dashboard-api
  2 days, 10 hours ago
• @LeSuisse ignored reference https://g… 2 days, 10 hours ago
• @LeSuisse accepted 2 days, 10 hours ago
• @LeSuisse published on GitHub 2 days, 10 hours ago

ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

• https://github.com/esphome/esphome/blob/dev/esphome/components/web_server/web_s…

Ignored references (1)

• https://github.com/esphome/esphome

---

esphome

• =<2026.7.0

NIXPKGS-2026-2362

GitHub issue published 2 days, 10 hours ago

ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

Permalink CVE-2026-71259

8.6 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 days, 10 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse ignored
  8 packages

  • python313Packages.aioesphomeapi
  • python313Packages.bleak-esphome
  • python314Packages.aioesphomeapi
  • python314Packages.bleak-esphome
  • python313Packages.esphome-glyphsets
  • python314Packages.esphome-glyphsets
  • python313Packages.esphome-dashboard-api
  • python314Packages.esphome-dashboard-api
  2 days, 10 hours ago
• @LeSuisse ignored reference https://g… 2 days, 10 hours ago
• @LeSuisse accepted 2 days, 10 hours ago
• @LeSuisse published on GitHub 2 days, 10 hours ago

ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

• https://github.com/esphome/esphome/blob/dev/esphome/config_validation.py

Ignored references (1)

• https://github.com/esphome/esphome

---

esphome

• =<2026.7.0