NIXPKGS-2026-1892

GitHub issue published 9 hours ago

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

Permalink CVE-2026-11611

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored reference https://r… 9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

• https://access.redhat.com/security/cve/CVE-2026-11611 vdb-entryx_refsource_REDHAT
• RHBZ#2485424 issue-trackingx_refsource_REDHAT

Ignored references (1)

• https://redhat.atlassian.net/browse/PSIRTSUPT-7600

---

389-ds-base

redhat-ds:11/389-ds-base

redhat-ds:12/389-ds-base

NIXPKGS-2026-1891

GitHub issue published 9 hours ago

AdGuard Home Authentication Bypass via Path Traversal in Admin-Token Cookie

Permalink CVE-2026-41448

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.adguardhome
  • python314Packages.adguardhome
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

AdGuard Home Authentication Bypass via Path Traversal in Admin-Token Cookie

• https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.77 release-notes
• https://www.vulncheck.com/advisories/adguard-home-authentication-bypass-via-pat… third-party-advisory

---

AdGuardHome

• <0.107.77

NIXPKGS-2026-1890

GitHub issue published 9 hours ago

Neovim View Branch secure.lua M.read command injection

Permalink CVE-2026-11487

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  4 references

  • https://github.com/neovim/neovim/
  • CVE-2026-11487 | CVE Analysis and Report
  • VDB-369107 | CTI Indicators (IOB, IOC, …
  • Submit #834495 | Neovim Neovim <= 0.12…
  9 hours ago
• @LeSuisse ignored
  9 packages

  • libvterm-neovim
  • neovim-remote
  • neovim-gtk
  • neovim-qt
  • neovim-qt-unwrapped
  • perlPackages.NeovimExt
  • perl5Packages.NeovimExt
  • vimPlugins.LanguageClient-neovim
  • vscode-extensions.asvetliakov.vscode-neovim
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Neovim View Branch secure.lua M.read command injection

• VDB-369107 | Neovim View Branch secure.lua M.read command injection vdb-entrytechnical-description
• https://github.com/neovim/neovim/issues/39914 issue-trackingexploit
• https://github.com/neovim/neovim/pull/39918 issue-trackingpatch
• https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de94828341b0a1a61a86c75baf patch

Ignored references (4)

• https://github.com/neovim/neovim/ product
• CVE-2026-11487 | CVE Analysis and Report third-party-advisory
• VDB-369107 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• Submit #834495 | Neovim Neovim <= 0.12.2 command injection third-party-advisory

---

Neovim

• ==0.12.0
• ==0.12.1
• ==0.12.2

NIXPKGS-2026-1889

GitHub issue published 9 hours ago

YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)

Permalink CVE-2026-52778

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)

• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-px5m-h76g-p7p8 x_refsource_CONFIRM
• https://github.com/YesWiki/yeswiki/commit/dd2bd8fb099de0d21504bda8a810693b3fcb8e52 x_refsource_MISC
• https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6 x_refsource_MISC

---

yeswiki

• ==< 4.6.6

NIXPKGS-2026-1888

GitHub issue published 9 hours ago

Weaviate Static API Key client.go validateConfig authorization

Permalink CVE-2026-11500

1.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  4 references

  • https://github.com/weaviate/weaviate/
  • Submit #835080 | weaviate 20f14bed78edd…
  • CVE-2026-11500 | CVE Analysis and Report
  • VDB-369120 | CTI Indicators (IOB, IOC, …
  9 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.weaviate-client
  • python314Packages.weaviate-client
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Weaviate Static API Key client.go validateConfig authorization

• VDB-369120 | Weaviate Static API Key client.go validateConfig authorization vdb-entrytechnical-description
• https://github.com/weaviate/weaviate/issues/11392 issue-trackingexploit
• https://github.com/weaviate/weaviate/commit/40f2cc32279f0f8a51016c3c6870a2c0c80… patch
• https://github.com/weaviate/weaviate/releases/tag/v1.38.0-rc.0 patch

Ignored references (4)

• https://github.com/weaviate/weaviate/ product
• Submit #835080 | weaviate 20f14bed78eddac098f84aad97204c0d86ad0c34 Authorization Bypass third-party-advisory
• CVE-2026-11500 | CVE Analysis and Report third-party-advisory
• VDB-369120 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature

---

Weaviate

• ==1.38.0-rc.0
• ==1.37.3
• ==1.37.2
• ==1.37.0
• ==1.37.6
• ==1.37.7
• ==1.37.1
• ==1.37.4
• ==1.37.5

NIXPKGS-2026-1887

GitHub issue published 9 hours ago

Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user

Permalink CVE-2026-46484

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored package headplane-agent 9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user

• https://github.com/tale/headplane/security/advisories/GHSA-vgj6-hcf2-fqf6 x_refsource_CONFIRM
• https://github.com/tale/headplane/releases/tag/v0.6.3 x_refsource_MISC
• https://github.com/tale/headplane/releases/tag/v0.7.0-beta.3 x_refsource_MISC

---

headplane

• ==< 0.6.3
• ==>= 0.7.0-beta.1, < 0.7.0-beta.3

NIXPKGS-2026-1886

GitHub issue published 9 hours ago

Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

Permalink CVE-2026-48507

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

• https://github.com/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr x_refsource_CONFIRM
• https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a x_refsource_MISC

---

snipe-it

• ==< 8.6.0

NIXPKGS-2026-1885

GitHub issue published 9 hours ago

OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability …

Permalink CVE-2020-37248

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored reference https://p… 9 hours ago
• @LeSuisse ignored maintainer @stephen-huan 9 hours ago maintainer.ignore
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability …

• https://github.com/OfflineIMAP/offlineimap3/commit/46505c53ef995455d66c685f9ec3…
• https://github.com/OfflineIMAP/offlineimap3/issues/222
• https://github.com/OfflineIMAP/offlineimap/issues/669
• http://www.openwall.com/lists/oss-security/2026/06/08/3

Ignored references (1)

• https://pypi.org/project/offlineimap/#history

---

OfflineIMAP

• <8.0.3

NIXPKGS-2026-1884

GitHub issue published 9 hours ago

Samba: denial of service against ad dc wins server

Permalink CVE-2026-3238

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored package sambamba 9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse ignored maintainer @aneeshusa 9 hours ago maintainer.ignore
• @LeSuisse published on GitHub 9 hours ago

Samba: denial of service against ad dc wins server

• https://access.redhat.com/security/cve/CVE-2026-3238 vdb-entryx_refsource_REDHAT
• RHBZ#2486176 issue-trackingx_refsource_REDHAT
• https://www.samba.org/samba/security/CVE-2026-3238.html

---

rhcos

samba

samba4

NIXPKGS-2026-1883

GitHub issue published 9 hours ago

Routinator: 0.15.2 security release

Permalink CVE-2026-49233

8.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Routinator cache path traversal using rogue rsync URIs

• https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49233.txt vendor-advisory

---

Routinator

• *

Permalink CVE-2026-49232

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Routinator exits when accepting an incoming HTTP or RTR connection fails

• https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49232.txt vendor-advisory

---

Routinator

• *

Permalink CVE-2026-49235

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Routinator crashes on specifically crafted RRDP XML files

• https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49235.txt vendor-advisory

---

Routinator

• *

Permalink CVE-2026-49234

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Routinator crashes on specifically crafted ASN strings in the API

• https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49234.txt vendor-advisory

---

Routinator

• *