Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-2726
published 7 hours ago
psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry
Permalink CVE-2026-59991
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry

psd-tools
  • ==< 1.17.4
NIXPKGS-2026-2725
published 7 hours ago
Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu
Permalink CVE-2026-95508
7.4 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

libslirp
openshift/ose-rhel-coreos-8
openshift/ose-rhel-coreos-9
container-tools:rhel8/libslirp
Patches in 4.9.5: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/97f2dd0afea0db8b31135f768ecafe0775722a25 and https://gitlab.freedesktop.org/slirp/libslirp/-/commit/5815f119c334c26e6e7a14ac87eca12b69918627
The TFTP part seems to be missing
NIXPKGS-2026-2724
published 7 hours ago
AT_SECURE program buffer overflow via $ORIGIN processing
Permalink CVE-2026-95818
3.6 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    17 packages
    • libc
    • iconv
    • getent
    • locale
    • mtrace
    • getconf
    • libiconv
    • glibcInfo
    • glibc_multi
    • glibcLocales
    • glibc_memusage
    • glibcLocalesUtf8
    • unixtools.getent
    • unixtools.locale
    • unixtools.getconf
    • minimal-bootstrap.glibc
    • minimal-bootstrap.glibc-headers
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

AT_SECURE program buffer overflow via $ORIGIN processing

glibc
  • <2.45
NIXPKGS-2026-2723
published 7 hours ago
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon …
Permalink CVE-2026-96269
7.5 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    19 packages
    • qemacs
    • uemacs
    • emacs30
    • emacs-gtk
    • chemacs2
    • emacspeak
    • emacs-anywhere
    • pinentry-emacs
    • emacs30-macport
    • emacs-lsp-booster
    • parinfer-rust-emacs
    • emacsclient-commands
    • emacs-all-the-icons-fonts
    • haskellPackages.emacs-module
    • haskellPackages.yi-keymap-emacs
    • haskellPackages.yi-emacs-colours
    • vscode-extensions.tuttieee.emacs-mcx
    • gnomeExtensions.emacs-search-provider
    • vscode-extensions.jamesyang999.vscode-emacs-minimum
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon …

Emacs
  • =<31.1
NIXPKGS-2026-2722
published 7 hours ago
Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information
Permalink CVE-2026-75608
7.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored package home-assistant-custom-components.frigate 7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information

frigate
  • ==< 0.18.0
NIXPKGS-2026-2721
published 7 hours ago
wlc may disclose API tokens to project-configured URLs
Permalink CVE-2026-62364
2.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    3 packages
    • wlcs
    • wlclock
    • imewlconverter
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

wlc may disclose API tokens to project-configured URLs

wlc
  • ==< 2.0.1 
Needs a backport / fix for stable
NIXPKGS-2026-2720
published 7 hours ago
netdata: security issues < 2.11.0 (backport needed)
Permalink CVE-2026-83597
7.0 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    5 packages
    • netdataCloud
    • python313Packages.netdata
    • python314Packages.netdata
    • python313Packages.netdata-pandas
    • python314Packages.netdata-pandas
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

netdata
  • ==>= 2.0.0, < 2.10.4
Permalink CVE-2026-83602
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    5 packages
    • netdataCloud
    • python313Packages.netdata
    • python314Packages.netdata
    • python313Packages.netdata-pandas
    • python314Packages.netdata-pandas
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK

netdata
  • ==>= 2.0.0, < 2.11.0
Permalink CVE-2026-83601
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    5 packages
    • netdataCloud
    • python313Packages.netdata
    • python314Packages.netdata
    • python313Packages.netdata-pandas
    • python314Packages.netdata-pandas
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write

netdata
  • ==< 2.10.4
Permalink CVE-2026-83600
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    5 packages
    • netdataCloud
    • python313Packages.netdata
    • python314Packages.netdata
    • python313Packages.netdata-pandas
    • python314Packages.netdata-pandas
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent

netdata
  • ==< 2.10.4
Permalink CVE-2026-83603
8.4 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    5 packages
    • netdataCloud
    • python313Packages.netdata
    • python314Packages.netdata
    • python313Packages.netdata-pandas
    • python314Packages.netdata-pandas
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE

netdata
  • ==< 2.10.4
Permalink CVE-2026-83598
7.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    5 packages
    • netdataCloud
    • python313Packages.netdata
    • python314Packages.netdata
    • python313Packages.netdata-pandas
    • python314Packages.netdata-pandas
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair

netdata
  • ==>= 2.0.0, < 2.10.4 
Needs a backport
Permalink CVE-2026-83599
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    5 packages
    • python313Packages.netdata
    • python314Packages.netdata
    • python313Packages.netdata-pandas
    • python314Packages.netdata-pandas
    • netdataCloud
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Netdata: WebSocket Decompression Bomb

netdata
  • ==< 2.11.0 
Needs a backport
NIXPKGS-2026-2719
published 7 hours ago
radare2: security issues < 6.2.0 (backport needed)
Permalink CVE-2026-81878
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser

radare2
  • ==< 6.2.0
Permalink CVE-2026-81884
2.5 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser

radare2
  • ==< 6.2.0
Permalink CVE-2026-81885
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser

radare2
  • ==< 6.2.0
Permalink CVE-2026-81886
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

radare2: Uncontrolled memory allocation in radare2 dmp64 parser

radare2
  • ==< 6.2.0
Permalink CVE-2026-81882
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser

radare2
  • ==< 6.2.0
Permalink CVE-2026-81883
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode

radare2
  • ==< 6.2.0
Permalink CVE-2026-81881
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser

radare2
  • ==< 6.2.0 
Needs a backport
Permalink CVE-2026-81879
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling

radare2
  • ==< 6.2.0 
Needs a backport
Permalink CVE-2026-81880
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

radare2: Uncontrolled resource consumption in radare2 PEF loader

radare2
  • ==< 6.2.0
NIXPKGS-2026-2718
published 7 hours ago
vector: security issues < 0.57.0 (backport needed)
Permalink CVE-2026-77621
9.3 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): High (H)
  • Subsequent System Impact Availability (SA): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): High (H)
  • Modified Subsequent System Impact Availability (MSA): High (H)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    119 packages
    • pathvector
    • vector-blf
    • vectorcode
    • vectoroids
    • vectorscan
    • pkgsRocm.vectorcode
    • ocamlPackages.vector
    • haskellPackages.vector
    • perlPackages.BitVector
    • perl5Packages.BitVector
    • sbclPackages.cl-vectors
    • akkuPackages.pfds-vector
    • python313Packages.vector
    • python314Packages.vector
    • akkuPackages.rapid-vector
    • haskellPackages.AC-Vector
    • haskellPackages.gb-vector
    • haskellPackages.hw-vector
    • haskellPackages.bit-vector
    • haskellPackages.rrb-vector
    • haskellPackages.vector-fft
    • python313Packages.pgvector
    • python314Packages.pgvector
    • vimPlugins.vectorcode-nvim
    • haskellPackages.vector-fftw
    • haskellPackages.vector-mmap
    • haskellPackages.word-vector
    • ocamlPackages_latest.vector
    • postgresqlPackages.pgvector
    • sbclPackages.static-vectors
    • haskellPackages.fixed-vector
    • haskellPackages.vector-sized
    • haskellPackages.vector-space
    • haskellPackages.vector-split
    • akkuPackages.chibi-bytevector
    • akkuPackages.r6rs-bytevectors
    • haskellPackages.cereal-vector
    • haskellPackages.sparse-vector
    • haskellPackages.vector-binary
    • haskellPackages.vector-buffer
    • haskellPackages.vector-extras
    • haskellPackages.vector-rotcev
    • haskellPackages.vector-stream
    • postgresql14Packages.pgvector
    • postgresql15Packages.pgvector
    • postgresql16Packages.pgvector
    • postgresql17Packages.pgvector
    • postgresql18Packages.pgvector
    • postgresql19Packages.pgvector
    • haskellPackages.hybrid-vectors
    • haskellPackages.storablevector
    • haskellPackages.vector-builder
    • postgresqlPackages.vectorchord
    • haskellPackages.AC-Vector-Fancy
    • haskellPackages.hsndfile-vector
    • haskellPackages.nonempty-vector
    • haskellPackages.unboxing-vector
    • haskellPackages.validity-vector
    • haskellPackages.vector-th-unbox
    • python313Packages.staticvectors
    • python314Packages.staticvectors
    • haskellPackages.vector-instances
    • haskellPackages.vector-quicksort
    • postgresql14Packages.vectorchord
    • postgresql15Packages.vectorchord
    • postgresql16Packages.vectorchord
    • postgresql17Packages.vectorchord
    • postgresql18Packages.vectorchord
    • postgresqlPackages.pgvectorscale
    • haskellPackages.vector-algorithms
    • haskellPackages.vector-hashtables
    • haskellPackages.vector-strategies
    • haskellPackages.alternative-vector
    • haskellPackages.genvalidity-vector
    • postgresql14Packages.pgvectorscale
    • postgresql15Packages.pgvectorscale
    • postgresql16Packages.pgvectorscale
    • postgresql17Packages.pgvectorscale
    • postgresql18Packages.pgvectorscale
    • pkgsRocm.vimPlugins.vectorcode-nvim
    • haskellPackages.bytestring-to-vector
    • haskellPackages.edit-distance-vector
    • haskellPackages.hmatrix-vector-sized
    • haskellPackages.storablevector-carray
    • haskellPackages.vector-bytes-instances
    • pkgsRocm.python3Packages.staticvectors
    • python313Packages.bitvector-for-humans
    • python314Packages.bitvector-for-humans
    • haskellPackages.hsndfile-storablevector
    • haskellPackages.vector-binary-instances
    • chickenPackages_5.chickenEggs.dyn-vector
    • chickenPackages_5.chickenEggs.vector-lib
    • chickenPackages_6.chickenEggs.vector-lib
    • chickenPackages_5.chickenEggs.record-vector
    • chickenPackages_6.chickenEggs.record-vector
    • chickenPackages_5.chickenEggs.sparse-vectors
    • chickenPackages_6.chickenEggs.sparse-vectors
    • chickenPackages_5.chickenEggs.r6rs-bytevectors
    • chickenPackages_6.chickenEggs.bytevector-utils
    • chickenPackages_6.chickenEggs.r6rs-bytevectors
    • haskellPackages.uniqueness-periods-vector-stats
    • python313Packages.llama-index-vector-stores-faiss
    • python314Packages.llama-index-vector-stores-faiss
    • python313Packages.llama-index-vector-stores-chroma
    • python313Packages.llama-index-vector-stores-google
    • python313Packages.llama-index-vector-stores-milvus
    • python313Packages.llama-index-vector-stores-qdrant
    • python314Packages.llama-index-vector-stores-chroma
    • python314Packages.llama-index-vector-stores-google
    • python314Packages.llama-index-vector-stores-milvus
    • python314Packages.llama-index-vector-stores-qdrant
    • python313Packages.llama-index-vector-stores-postgres
    • python314Packages.llama-index-vector-stores-postgres
    • pkgsRocm.python3Packages.llama-index-vector-stores-faiss
    • pkgsRocm.python3Packages.llama-index-vector-stores-chroma
    • pkgsRocm.python3Packages.llama-index-vector-stores-google
    • pkgsRocm.python3Packages.llama-index-vector-stores-milvus
    • pkgsRocm.python3Packages.llama-index-vector-stores-qdrant
    • pkgsRocm.python3Packages.llama-index-vector-stores-postgres
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Vector: Arbitrary file write in the file sink via templated path (path traversal).

vector
  • ==>= 0.10.0, < 0.57.0
Permalink CVE-2026-77620
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    119 packages
    • pathvector
    • vector-blf
    • vectorcode
    • vectoroids
    • vectorscan
    • pkgsRocm.vectorcode
    • ocamlPackages.vector
    • haskellPackages.vector
    • perlPackages.BitVector
    • perl5Packages.BitVector
    • sbclPackages.cl-vectors
    • akkuPackages.pfds-vector
    • python313Packages.vector
    • python314Packages.vector
    • akkuPackages.rapid-vector
    • haskellPackages.AC-Vector
    • haskellPackages.gb-vector
    • haskellPackages.hw-vector
    • haskellPackages.bit-vector
    • haskellPackages.rrb-vector
    • haskellPackages.vector-fft
    • python313Packages.pgvector
    • python314Packages.pgvector
    • vimPlugins.vectorcode-nvim
    • haskellPackages.vector-fftw
    • haskellPackages.vector-mmap
    • haskellPackages.word-vector
    • ocamlPackages_latest.vector
    • postgresqlPackages.pgvector
    • sbclPackages.static-vectors
    • haskellPackages.fixed-vector
    • haskellPackages.vector-sized
    • haskellPackages.vector-space
    • haskellPackages.vector-split
    • akkuPackages.chibi-bytevector
    • akkuPackages.r6rs-bytevectors
    • haskellPackages.cereal-vector
    • haskellPackages.sparse-vector
    • haskellPackages.vector-binary
    • haskellPackages.vector-buffer
    • haskellPackages.vector-extras
    • haskellPackages.vector-rotcev
    • haskellPackages.vector-stream
    • postgresql14Packages.pgvector
    • postgresql15Packages.pgvector
    • postgresql16Packages.pgvector
    • postgresql17Packages.pgvector
    • postgresql18Packages.pgvector
    • postgresql19Packages.pgvector
    • haskellPackages.hybrid-vectors
    • haskellPackages.storablevector
    • haskellPackages.vector-builder
    • postgresqlPackages.vectorchord
    • haskellPackages.AC-Vector-Fancy
    • haskellPackages.hsndfile-vector
    • haskellPackages.nonempty-vector
    • haskellPackages.unboxing-vector
    • haskellPackages.validity-vector
    • haskellPackages.vector-th-unbox
    • python313Packages.staticvectors
    • python314Packages.staticvectors
    • haskellPackages.vector-instances
    • haskellPackages.vector-quicksort
    • postgresql14Packages.vectorchord
    • postgresql15Packages.vectorchord
    • postgresql16Packages.vectorchord
    • postgresql17Packages.vectorchord
    • postgresql18Packages.vectorchord
    • postgresqlPackages.pgvectorscale
    • haskellPackages.vector-algorithms
    • haskellPackages.vector-hashtables
    • haskellPackages.vector-strategies
    • haskellPackages.alternative-vector
    • haskellPackages.genvalidity-vector
    • postgresql14Packages.pgvectorscale
    • postgresql15Packages.pgvectorscale
    • postgresql16Packages.pgvectorscale
    • postgresql17Packages.pgvectorscale
    • postgresql18Packages.pgvectorscale
    • pkgsRocm.vimPlugins.vectorcode-nvim
    • haskellPackages.bytestring-to-vector
    • haskellPackages.edit-distance-vector
    • haskellPackages.hmatrix-vector-sized
    • haskellPackages.storablevector-carray
    • haskellPackages.vector-bytes-instances
    • pkgsRocm.python3Packages.staticvectors
    • python313Packages.bitvector-for-humans
    • python314Packages.bitvector-for-humans
    • haskellPackages.hsndfile-storablevector
    • haskellPackages.vector-binary-instances
    • chickenPackages_5.chickenEggs.dyn-vector
    • chickenPackages_5.chickenEggs.vector-lib
    • chickenPackages_6.chickenEggs.vector-lib
    • chickenPackages_5.chickenEggs.record-vector
    • chickenPackages_6.chickenEggs.record-vector
    • chickenPackages_5.chickenEggs.sparse-vectors
    • chickenPackages_6.chickenEggs.sparse-vectors
    • chickenPackages_5.chickenEggs.r6rs-bytevectors
    • chickenPackages_6.chickenEggs.bytevector-utils
    • chickenPackages_6.chickenEggs.r6rs-bytevectors
    • haskellPackages.uniqueness-periods-vector-stats
    • python313Packages.llama-index-vector-stores-faiss
    • python314Packages.llama-index-vector-stores-faiss
    • python313Packages.llama-index-vector-stores-chroma
    • python313Packages.llama-index-vector-stores-google
    • python313Packages.llama-index-vector-stores-milvus
    • python313Packages.llama-index-vector-stores-qdrant
    • python314Packages.llama-index-vector-stores-chroma
    • python314Packages.llama-index-vector-stores-google
    • python314Packages.llama-index-vector-stores-milvus
    • python314Packages.llama-index-vector-stores-qdrant
    • python313Packages.llama-index-vector-stores-postgres
    • python314Packages.llama-index-vector-stores-postgres
    • pkgsRocm.python3Packages.llama-index-vector-stores-faiss
    • pkgsRocm.python3Packages.llama-index-vector-stores-chroma
    • pkgsRocm.python3Packages.llama-index-vector-stores-google
    • pkgsRocm.python3Packages.llama-index-vector-stores-milvus
    • pkgsRocm.python3Packages.llama-index-vector-stores-qdrant
    • pkgsRocm.python3Packages.llama-index-vector-stores-postgres
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).

vector
  • ==>= 0.15.0, < 0.57.0
Permalink CVE-2026-77619
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse ignored
    119 packages
    • pathvector
    • vector-blf
    • vectorcode
    • vectoroids
    • vectorscan
    • pkgsRocm.vectorcode
    • ocamlPackages.vector
    • haskellPackages.vector
    • perlPackages.BitVector
    • perl5Packages.BitVector
    • sbclPackages.cl-vectors
    • akkuPackages.pfds-vector
    • python313Packages.vector
    • python314Packages.vector
    • akkuPackages.rapid-vector
    • haskellPackages.AC-Vector
    • haskellPackages.gb-vector
    • haskellPackages.hw-vector
    • haskellPackages.bit-vector
    • haskellPackages.rrb-vector
    • haskellPackages.vector-fft
    • python313Packages.pgvector
    • python314Packages.pgvector
    • vimPlugins.vectorcode-nvim
    • haskellPackages.vector-fftw
    • haskellPackages.vector-mmap
    • haskellPackages.word-vector
    • ocamlPackages_latest.vector
    • postgresqlPackages.pgvector
    • sbclPackages.static-vectors
    • haskellPackages.fixed-vector
    • haskellPackages.vector-sized
    • haskellPackages.vector-space
    • haskellPackages.vector-split
    • akkuPackages.chibi-bytevector
    • akkuPackages.r6rs-bytevectors
    • haskellPackages.cereal-vector
    • haskellPackages.sparse-vector
    • haskellPackages.vector-binary
    • haskellPackages.vector-buffer
    • haskellPackages.vector-extras
    • haskellPackages.vector-rotcev
    • haskellPackages.vector-stream
    • postgresql14Packages.pgvector
    • postgresql15Packages.pgvector
    • postgresql16Packages.pgvector
    • postgresql17Packages.pgvector
    • postgresql18Packages.pgvector
    • postgresql19Packages.pgvector
    • haskellPackages.hybrid-vectors
    • haskellPackages.storablevector
    • haskellPackages.vector-builder
    • postgresqlPackages.vectorchord
    • haskellPackages.AC-Vector-Fancy
    • haskellPackages.hsndfile-vector
    • haskellPackages.nonempty-vector
    • haskellPackages.unboxing-vector
    • haskellPackages.validity-vector
    • haskellPackages.vector-th-unbox
    • python313Packages.staticvectors
    • python314Packages.staticvectors
    • haskellPackages.vector-instances
    • haskellPackages.vector-quicksort
    • postgresql14Packages.vectorchord
    • postgresql15Packages.vectorchord
    • postgresql16Packages.vectorchord
    • postgresql17Packages.vectorchord
    • postgresql18Packages.vectorchord
    • postgresqlPackages.pgvectorscale
    • haskellPackages.vector-algorithms
    • haskellPackages.vector-hashtables
    • haskellPackages.vector-strategies
    • haskellPackages.alternative-vector
    • haskellPackages.genvalidity-vector
    • postgresql14Packages.pgvectorscale
    • postgresql15Packages.pgvectorscale
    • postgresql16Packages.pgvectorscale
    • postgresql17Packages.pgvectorscale
    • postgresql18Packages.pgvectorscale
    • pkgsRocm.vimPlugins.vectorcode-nvim
    • haskellPackages.bytestring-to-vector
    • haskellPackages.edit-distance-vector
    • haskellPackages.hmatrix-vector-sized
    • haskellPackages.storablevector-carray
    • haskellPackages.vector-bytes-instances
    • pkgsRocm.python3Packages.staticvectors
    • python313Packages.bitvector-for-humans
    • python314Packages.bitvector-for-humans
    • haskellPackages.hsndfile-storablevector
    • haskellPackages.vector-binary-instances
    • chickenPackages_5.chickenEggs.dyn-vector
    • chickenPackages_5.chickenEggs.vector-lib
    • chickenPackages_6.chickenEggs.vector-lib
    • chickenPackages_5.chickenEggs.record-vector
    • chickenPackages_6.chickenEggs.record-vector
    • chickenPackages_5.chickenEggs.sparse-vectors
    • chickenPackages_6.chickenEggs.sparse-vectors
    • chickenPackages_5.chickenEggs.r6rs-bytevectors
    • chickenPackages_6.chickenEggs.bytevector-utils
    • chickenPackages_6.chickenEggs.r6rs-bytevectors
    • haskellPackages.uniqueness-periods-vector-stats
    • python313Packages.llama-index-vector-stores-faiss
    • python314Packages.llama-index-vector-stores-faiss
    • python313Packages.llama-index-vector-stores-chroma
    • python313Packages.llama-index-vector-stores-google
    • python313Packages.llama-index-vector-stores-milvus
    • python313Packages.llama-index-vector-stores-qdrant
    • python314Packages.llama-index-vector-stores-chroma
    • python314Packages.llama-index-vector-stores-google
    • python314Packages.llama-index-vector-stores-milvus
    • python314Packages.llama-index-vector-stores-qdrant
    • python313Packages.llama-index-vector-stores-postgres
    • python314Packages.llama-index-vector-stores-postgres
    • pkgsRocm.python3Packages.llama-index-vector-stores-faiss
    • pkgsRocm.python3Packages.llama-index-vector-stores-chroma
    • pkgsRocm.python3Packages.llama-index-vector-stores-google
    • pkgsRocm.python3Packages.llama-index-vector-stores-milvus
    • pkgsRocm.python3Packages.llama-index-vector-stores-qdrant
    • pkgsRocm.python3Packages.llama-index-vector-stores-postgres
    7 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

vector
  • ==>= 0.15.0, < 0.57.0 
Needs a backport
NIXPKGS-2026-2717
published 7 hours ago
perlPackages.NetIDNEncode: security issues < 2.590
Permalink CVE-2026-87078
9.1 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode

Net-IDN-Encode
  • <2.590
Permalink CVE-2026-87081
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii

Net-IDN-Encode
  • <2.590
Permalink CVE-2026-87082
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode

Net-IDN-Encode
  • <2.590
Permalink CVE-2026-74765
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode

Net-IDN-Encode
  • <2.590
Permalink CVE-2026-74766
8.4 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode

Net-IDN-Encode
  • <2.590
Permalink CVE-2026-87079
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode

Net-IDN-Encode
  • <2.590
Permalink CVE-2026-87080
9.1 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 17 hours ago
  • @LeSuisse accepted 7 hours ago
  • @LeSuisse published on GitHub 7 hours ago

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode

Net-IDN-Encode
  • <2.590