NIXPKGS-2026-2141

GitHub issue published 12 hours ago

Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries

Permalink CVE-2026-59269

3.8 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 12 hours ago

Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries

• https://github.com/vmware/pinniped/security/advisories/GHSA-7xq8-m6h6-2xg8

---

Pinniped

• =<0.46.0

NIXPKGS-2026-2140

GitHub issue published 12 hours ago

GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds

Permalink CVE-2026-15185

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse ignored
  4 references

  • VDB-377111 | CTI Indicators (IOB, IOC, …
  • CVE-2026-15185 | CVE Analysis and Report
  • Submit #851214 | GPAC GPAC 26.03-DEV Ou…
  • https://github.com/gpac/gpac/
  14 hours ago
• @LeSuisse ignored
  32 packages

  • msgpack-cxx
  • msgpack-c
  • msgpack-tools
  • rubyPackages.msgpack
  • phpExtensions.msgpack
  • haskellPackages.msgpack
  • perlPackages.MsgPackRaw
  • php82Extensions.msgpack
  • php83Extensions.msgpack
  • php84Extensions.msgpack
  • php85Extensions.msgpack
  • luaPackages.lua-cmsgpack
  • perl5Packages.MsgPackRaw
  • rubyPackages_3_3.msgpack
  • rubyPackages_3_4.msgpack
  • rubyPackages_4_0.msgpack
  • python313Packages.msgpack
  • python314Packages.msgpack
  • lua51Packages.lua-cmsgpack
  • lua52Packages.lua-cmsgpack
  • lua53Packages.lua-cmsgpack
  • lua54Packages.lua-cmsgpack
  • lua55Packages.lua-cmsgpack
  • python313Packages.ormsgpack
  • python314Packages.ormsgpack
  • haskellPackages.data-msgpack
  • python313Packages.msgpack-numpy
  • python314Packages.msgpack-numpy
  • haskellPackages.data-msgpack-types
  • python313Packages.u-msgpack-python
  • python314Packages.u-msgpack-python
  • chickenPackages_5.chickenEggs.msgpack
  14 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 12 hours ago

GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds

• VDB-377111 | GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds vdb-entrytechnical-description
• https://github.com/gpac/gpac/issues/3611 exploitissue-tracking
• https://github.com/gpac/gpac/commit/aa0fb77b82e51b159a2024c440cdf6b571b14d81 patch
• https://github.com/gpac/gpac/commit/532097084729a936bcdf6a27c41003f3bd7dc3ff patch

Ignored references (4)

• VDB-377111 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-15185 | CVE Analysis and Report third-party-advisory
• Submit #851214 | GPAC GPAC 26.03-DEV Out-of-Bounds Read third-party-advisory
• https://github.com/gpac/gpac/ product

---

GPAC

• ==26.03-DEV

NIXPKGS-2026-2139

GitHub issue published 12 hours ago

gpsd gpsprof Command Injection via gnuplot plot title subtype field

Permalink CVE-2026-58459

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse ignored package indi-3rdparty.indi-gpsd 14 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 12 hours ago

gpsd gpsprof Command Injection via gnuplot plot title subtype field

• https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267 issue-tracking
• Patch Commit (1) patch
• Patch Commit (2) patch
• Patch Commit (3) patch
• https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot… third-party-advisory

---

gpsd

• =<3.27.5
• =<4c06658e988f4ced1a7a574ce082a22ef625df56

NIXPKGS-2026-2138

GitHub issue published 12 hours ago

Open5GS AMF context.c amf_context_final use after free

Permalink CVE-2026-15194

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse ignored package open5gs-webui 14 hours ago
• @LeSuisse ignored
  3 references

  • https://github.com/open5gs/open5gs/
  • CVE-2026-15194 | CVE Analysis and Report
  • VDB-377122 | CTI Indicators (IOB, IOC, …
  14 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 12 hours ago

Open5GS AMF context.c amf_context_final use after free

• VDB-377122 | Open5GS AMF context.c amf_context_final use after free vdb-entrytechnical-description
• Submit #851630 | Open5GS Project Open5GS 2.7.7 Use After Free third-party-advisory
• https://github.com/open5gs/open5gs/security/advisories/GHSA-88pq-hpwv-2vjw exploit

Ignored references (3)

• https://github.com/open5gs/open5gs/ product
• CVE-2026-15194 | CVE Analysis and Report third-party-advisory
• VDB-377122 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature

---

Open5GS

• ==2.7.7

NIXPKGS-2026-2137

GitHub issue published 12 hours ago

Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Permalink CVE-2026-59149

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 12 hours ago

Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

• https://github.com/mockoon/mockoon/security/advisories/GHSA-8wqc-v2q8-vff2 exploitx_refsource_CONFIRM
• https://github.com/mockoon/mockoon/pull/2255 x_refsource_MISC
• https://github.com/mockoon/mockoon/commit/b42bdfb7f82e83f0e81bea8e6fe41adf5ec82585 x_refsource_MISC
• https://github.com/mockoon/mockoon/releases/tag/v9.7.0 x_refsource_MISC
• https://mockoon.com/releases/9.7.0 x_refsource_MISC

---

mockoon

• ==< 9.7.0

NIXPKGS-2026-2136

GitHub issue published 12 hours ago

Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

Permalink CVE-2026-59826

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 12 hours ago

Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

• https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35 x_refsource_CONFIRM
• https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01 x_refsource_MISC
• https://github.com/metabase/metabase/releases/tag/v0.58.15.1 x_refsource_MISC
• https://github.com/metabase/metabase/releases/tag/v0.59.12 x_refsource_MISC
• https://github.com/metabase/metabase/releases/tag/v0.60.6.3 x_refsource_MISC
• https://github.com/metabase/metabase/releases/tag/v0.61.2 x_refsource_MISC

---

metabase

• ==>= 1.61.0, < 1.61.2
• ==>= 1.60.0, < 1.60.6.3
• ==>= 1.55.0, < 1.58.15.1
• ==>= 1.59.0, < 1.59.12

NIXPKGS-2026-2135

GitHub issue published 12 hours ago

zeek: security issues < 8.0.9

Permalink CVE-2026-60108

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse ignored
  6 packages

  • zeekstd
  • zeekscript
  • python313Packages.zeek
  • python314Packages.zeek
  • python313Packages.tree-sitter-zeek
  • python314Packages.tree-sitter-zeek
  12 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

Zeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzer

• Release Notes release-notes
• Patch Commit patch
• https://www.vulncheck.com/advisories/zeek-uncontrolled-memory-consumption-dos-v… third-party-advisory

---

zeek

• <8.0.9

Permalink CVE-2026-60109

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse ignored
  6 packages

  • zeekstd
  • zeekscript
  • python313Packages.zeek
  • python314Packages.zeek
  • python313Packages.tree-sitter-zeek
  • python314Packages.tree-sitter-zeek
  12 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

Zeek < 8.0.9 Null Pointer Dereference DoS via Kerberos KRB_ERROR Parsing

• Release Notes release-notes
• Patch Commit patch
• https://www.vulncheck.com/advisories/zeek-null-pointer-dereference-dos-via-kerb… third-party-advisory

---

zeek

• <8.0.9

NIXPKGS-2026-2134

GitHub issue published 14 hours ago

bosh-cli: security issues < 7.10.4

Permalink CVE-2026-47828

8.9 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 14 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 14 hours ago

Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay

• https://www.cloudfoundry.org/blog/cve-2026-47828-missing-tls-certificate-verifi…

---

bosh-cli

• <7.10.4

Permalink CVE-2026-47829

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 14 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 14 hours ago

Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director

• https://www.cloudfoundry.org/blog/cve-2026-47829-argument-injection-in-bosh-cli…

---

bosh-cli

• <7.10.4

NIXPKGS-2026-2133

GitHub issue published 14 hours ago

openfga: security issues < 1.18.0

Permalink CVE-2026-55689

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 14 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse ignored
  3 packages

  • openfga-cli
  • python313Packages.openfga-sdk
  • python314Packages.openfga-sdk
  14 hours ago
• @LeSuisse ignored
  2 references

  • https://github.com/openfga/helm-ch
  • https://github.com/openfga/helm-charts/…
  14 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 14 hours ago

OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

• https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv x_refsource_CONFIRM
• https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271 x_refsource_MISC
• https://github.com/openfga/openfga/releases/tag/v1.18.0 x_refsource_MISC

Ignored references (2)

• https://github.com/openfga/helm-ch x_refsource_MISC
• https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9 x_refsource_MISC

---

openfga

• ==< 1.18.0

Needs some backports to stable

Permalink CVE-2026-55170

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 14 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse ignored
  3 packages

  • openfga-cli
  • python313Packages.openfga-sdk
  • python314Packages.openfga-sdk
  14 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 14 hours ago

OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

• https://github.com/openfga/openfga/security/advisories/GHSA-cf98-j28v-49v6 x_refsource_CONFIRM
• https://github.com/openfga/helm-charts/commit/96d5517a2693ff5def451dee7d6b9d1baeb281f8 x_refsource_MISC
• https://github.com/openfga/openfga/commit/a2e0dbefc3e01a95c785f81a3563bc6571b08b11 x_refsource_MISC
• https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9 x_refsource_MISC
• https://github.com/openfga/openfga/releases/tag/v1.18.0 x_refsource_MISC

---

openfga

• ==< 1.18.0

Needs some backports to stable

NIXPKGS-2026-2132

GitHub issue published 14 hours ago

hoppscotch: security issues < 2026.6.0

Permalink CVE-2026-59721

7.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 14 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 14 hours ago

Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-v7q6-r45w-2c6r exploitx_refsource_CONFIRM
• https://github.com/hoppscotch/hoppscotch/pull/6413 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/commit/73a88c82b1b2cada26cc4b2bc095b54554242239 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0 x_refsource_MISC

---

hoppscotch

• ==< 2026.6.0

Permalink CVE-2026-59720

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 14 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 14 hours ago

Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server

• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-c68f-wr5p-j6jf exploitx_refsource_CONFIRM
• https://github.com/hoppscotch/hoppscotch/pull/6410 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/commit/e4332110d455a3012d5c77a9186bc4aa096e34f2 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0 x_refsource_MISC

---

hoppscotch

• ==< 2026.6.0