NIXPKGS-2026-2506

GitHub issue published 7 hours ago

Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal

Permalink CVE-2026-71219

4.7 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 7 hours ago

Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal

• https://access.redhat.com/security/cve/CVE-2026-71219 vdb-entryx_refsource_REDHAT
• RHBZ#2507750 issue-trackingx_refsource_REDHAT

---

gfs2-utils

No upstream fix as of 2026-09-04

NIXPKGS-2026-2505

GitHub issue published 7 hours ago

WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability

Permalink CVE-2026-84774

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 7 hours ago

WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability

• https://patchstack.com/database/wordpress/plugin/wp-statistics/vulnerability/wo… vdb-entry

---

wp-statistics

• =<14.16.11

NIXPKGS-2026-2504

GitHub issue published 7 hours ago

DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid

Permalink CVE-2026-85176

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 7 hours ago

DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid

• GitHub Issue #1502 issue-tracking
• https://github.com/dbgate/dbgate product
• getJslFileName.js at v7.2.6 technical-description
• jsldata.js at v7.2.6 technical-description
• VulnCheck Advisory: DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid third-party-advisory

---

dbgate

• =<7.2.6

NIXPKGS-2026-2503

GitHub issue published 7 hours ago

Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture

Permalink CVE-2026-85242

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 7 hours ago

Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture

• https://github.com/Lookyloo/PlaywrightCapture/commit/b912a04f7b190807b5e14e4970… patch

---

PlaywrightCapture

• <v1.41.2

NIXPKGS-2026-2502

GitHub issue published 7 hours ago

util-linux libmount Privilege Escalation via Failed Mount Helper

Permalink CVE-2026-76642

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored
  28 packages

  • more
  • wall
  • eject
  • mount
  • logger
  • umount
  • hexdump
  • libuuid
  • utillinux
  • libsmartcols
  • unixtools.col
  • unixtools.fsck
  • unixtools.more
  • unixtools.wall
  • unixtools.eject
  • unixtools.fdisk
  • unixtools.mount
  • unixtools.write
  • unixtools.column
  • unixtools.getopt
  • unixtools.logger
  • unixtools.script
  • unixtools.umount
  • unixtools.hexdump
  • unixtools.whereis
  • util-linuxMinimal
  • uutils-util-linux
  • unixtools.util-linux
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 7 hours ago

util-linux libmount Privilege Escalation via Failed Mount Helper

• GitHub Security Advisory (GHSA-m25x-3hj9-m26f) vendor-advisoryexploit
• Patch Commit patch
• Patch Commit patch
• Patch Commit patch
• https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_moun… technical-description
• https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_moun… technical-description
• https://github.com/util-linux/util-linux product
• VulnCheck Advisory: util-linux libmount Privilege Escalation via Failed Mount Helper third-party-advisory

---

util-linux

• <2.41.6
• <2.42.3

NIXPKGS-2026-2501

GitHub issue published 7 hours ago

Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect

Permalink CVE-2026-85180

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored
  18 packages

  • gollama
  • ollama-cpu
  • nextjs-ollama-llm-ui
  • python313Packages.ollama
  • python314Packages.ollama
  • python313Packages.llm-ollama
  • python314Packages.llm-ollama
  • haskellPackages.ollama-haskell
  • gnomeExtensions.ollama-indicator
  • python313Packages.langchain-ollama
  • python314Packages.langchain-ollama
  • gnomeExtensions.ollama-cloud-indicator
  • python313Packages.llama-index-llms-ollama
  • python314Packages.llama-index-llms-ollama
  • python313Packages.llama-index-embeddings-ollama
  • python314Packages.llama-index-embeddings-ollama
  • pkgsRocm.python3Packages.llama-index-llms-ollama
  • pkgsRocm.python3Packages.llama-index-embeddings-ollama
  9 hours ago
• @LeSuisse restored package ollama-cpu 9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 7 hours ago

Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect

• GitHub Issue #17041 issue-tracking
• https://github.com/ollama/ollama product
• x/transfer/download.go at v0.33.2 technical-description
• VulnCheck Advisory: Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect third-party-advisory

---

ollama

• =<0.33.2

NIXPKGS-2026-2500

GitHub issue published 7 hours ago

Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass

Permalink CVE-2026-75035

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored
  2 packages

  • terraform-providers.rancher2
  • terraform-providers.rancher_rancher2
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 7 hours ago

Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass

• https://github.com/rancher/rancher/releases/tag/v2.15.1

---

Rancher

• <2.15.1

Needs something for stable

NIXPKGS-2026-2499

GitHub issue published 7 hours ago

SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization

Permalink CVE-2026-85241

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): Not Defined (X)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored
  6 packages

  • bloodhound-py
  • haskellPackages.bloodhound
  • python313Packages.bloodhound
  • python314Packages.bloodhound
  • python313Packages.bloodhound-py
  • python314Packages.bloodhound-py
  7 hours ago
• @LeSuisse accepted 7 hours ago
• @LeSuisse published on GitHub 7 hours ago

SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization

• VDB-398471 | SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization technical-descriptionvdb-entry
• VDB-398471 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• CVE-2026-85241 | CVE Analysis and Report third-party-advisory
• Submit #894488 | SpecterOps BloodHound 9.4.0 Improper Authorization third-party-advisory
• https://github.com/SpecterOps/BloodHound/commit/39d1276a63e95a7713f954dea632a19… patch
• https://github.com/SpecterOps/BloodHound/releases/tag/v9.6.0-rc1 patch
• https://github.com/SpecterOps/BloodHound/ product

---

BloodHound

• ==9.5.0
• ==9.6.0-rc1
• ==9.7.0-rc3
• ==9.5.1
• ==9.6.0
• ==9.0.0
• ==9.1.0
• ==9.4.0
• ==9.2.2

NIXPKGS-2026-2498

GitHub issue published 7 hours ago

rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

Permalink CVE-2026-85396

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse accepted 7 hours ago
• @LeSuisse published on GitHub 7 hours ago

rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

• Patch Commit patch
• https://github.com/rubyzip/rubyzip product
• rubyzip v3.4.0 Release Notes release-notes
• https://github.com/rubyzip/rubyzip/blob/v3.3.1/lib/zip/entry.rb technical-description
• https://github.com/geo-chen/oss/blob/main/rubyzip.md technical-description
• VulnCheck Advisory: rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix third-party-advisory

---

rubyzip

• <3.4.0
• ==3.4.0

NIXPKGS-2026-2497

GitHub issue published 7 hours ago

Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph

Permalink CVE-2026-85458

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored package libxpdf 7 hours ago
• @LeSuisse accepted 7 hours ago
• @LeSuisse published on GitHub 7 hours ago

Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph

• https://www.xpdfreader.com/security-bug/CVE-2026-85458.html

---

Xpdf

• ==4.06