NIXPKGS-2026-1967

GitHub issue published 11 hours ago

WebOb: Location header normalization during redirect leads to open redirect

Permalink CVE-2026-44889

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

WebOb: Location header normalization during redirect leads to open redirect

• https://github.com/Pylons/webob/security/advisories/GHSA-fh3h-vg37-cc95 x_refsource_CONFIRM

---

webob

• ==< 1.8.10

NIXPKGS-2026-1966

GitHub issue published 11 hours ago

LiteLLM: Authentication Bypass via Host Header Injection

Permalink CVE-2026-49468

9.5 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

LiteLLM: Authentication Bypass via Host Header Injection

• https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w x_refsource_CONFIRM
• https://github.com/BerriAI/litellm/releases/tag/v1.84.0 x_refsource_MISC

---

litellm

• ==< 1.84.0

https://github.com/NixOS/nixpkgs/pull/523540 needs a backport

NIXPKGS-2026-1965

GitHub issue published 11 hours ago

Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver

Permalink CVE-2026-12549

4.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse ignored package libsoup_2_4 11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver

• https://access.redhat.com/security/cve/CVE-2026-12549 vdb-entryx_refsource_REDHAT
• cve-2026-0716 x_refsource_REDHATtechnical-description
• RHBZ#2489999 x_refsource_REDHATissue-tracking
• https://gitlab.gnome.org/GNOME/libsoup/-/work_items/516

---

libsoup

libsoup3

NIXPKGS-2026-1964

GitHub issue published 11 hours ago

pypdf: Possible infinite loop when processing threads/articles in writer

Permalink CVE-2026-54651

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse ignored
  7 packages

  • capypdf
  • python313Packages.pypdf2
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python313Packages.pypdf3
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

pypdf: Possible infinite loop when processing threads/articles in writer

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9xf-7f8q-9mcj x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3839 x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.13.1 x_refsource_MISC

---

pypdf

• ==< 6.13.1

NIXPKGS-2026-1963

GitHub issue published 11 hours ago

NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

Permalink CVE-2026-54293

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

• https://github.com/nltk/nltk/security/advisories/GHSA-p4gq-832x-fm9v x_refsource_CONFIRMexploit
• https://github.com/nltk/nltk/pull/3575 x_refsource_MISC

---

nltk

• ==< 3.10.0-rc1

NIXPKGS-2026-1962

GitHub issue published 11 hours ago

ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c

Permalink CVE-2026-56109

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c

• Researcher Disclosure technical-descriptionexploit
• Release Notes release-notes
• Patch Commit patch
• https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-… third-party-advisory

---

alsa-lib

• <1.2.16.1

NIXPKGS-2026-1961

GitHub issue published 11 hours ago

Vite: `server.fs.deny` bypass on Windows alternate paths

Permalink CVE-2026-53571

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse ignored
  6 packages

  • vite
  • vscode-extensions.vitest.explorer
  • python313Packages.django-vite
  • vitetris
  • python314Packages.django-vite
  • vitess
  11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

Vite: `server.fs.deny` bypass on Windows alternate paths

• https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff x_refsource_CONFIRMexploit

---

vite

• ==>= 8.0.0, < 8.0.16
• ==< 6.4.3
• ==>= 7.0.0, < 7.3.5

NIXPKGS-2026-1960

GitHub issue published 11 hours ago

pypdf: Possible infinite loop when processing outlines/bookmarks in writer

Permalink CVE-2026-54531

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse ignored
  7 packages

  • capypdf
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

pypdf: Possible infinite loop when processing outlines/bookmarks in writer

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-m2v9-299j-rv96 x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3830 x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.13.0 x_refsource_MISC

---

pypdf

• ==< 6.13.0

NIXPKGS-2026-1959

GitHub issue published 11 hours ago

rubyPackages.net-imap: security issues < 0.5.15

Permalink CVE-2026-47242

5.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse ignored
  2 packages

  • perl5Packages.NetIMAPClient
  • perlPackages.NetIMAPClient
  11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

Net::IMAP: Command Injection via ID command argument

• https://github.com/ruby/net-imap/security/advisories/GHSA-46q3-7gv7-qmgg x_refsource_CONFIRM

---

net-imap

• ==< 0.5.15
• ==>= 0.6.0, < 0.6.4.1

Permalink CVE-2026-47241

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse ignored
  2 packages

  • perl5Packages.NetIMAPClient
  • perlPackages.NetIMAPClient
  11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

Net::IMAP: Denial of Service via incomplete raw argument validation

• https://github.com/ruby/net-imap/security/advisories/GHSA-c4fp-cxrr-mj66 x_refsource_CONFIRM

---

net-imap

• ==< 0.5.15
• ==>= 0.6.0, < 0.6.4.1

Permalink CVE-2026-47240

5.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse ignored
  2 packages

  • perl5Packages.NetIMAPClient
  • perlPackages.NetIMAPClient
  12 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 11 hours ago

Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

• https://github.com/ruby/net-imap/security/advisories/GHSA-8p34-64r3-mwg8 x_refsource_CONFIRM

---

net-imap

• ==< 0.5.15
• ==>= 0.6.0, < 0.6.4.1

NIXPKGS-2026-1958

GitHub issue published 11 hours ago

vLLM: security issues < 0.23.1rc0

Permalink CVE-2026-48746

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

vLLM: OpenAI auth bypass

• https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6 x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/43426 x_refsource_MISC
• https://x41-dsec.de/lab/advisories/x41-2026-002-starlette x_refsource_MISC

---

vllm

• ==>= 0.3.0, < 0.22.0

Permalink CVE-2026-53923

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow

• https://github.com/vllm-project/vllm/security/advisories/GHSA-5jv2-g5wq-cmr4 x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/44971 x_refsource_MISC
• https://github.com/vllm-project/vllm/commit/f219788f91952827132fa4fdf916427cd20d225e x_refsource_MISC

---

vllm

• ==>= 0.5.5, < 0.23.1rc0

Permalink CVE-2026-54233

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

vLLM: OOM Denial of Service via Audio Decompression Bomb

• https://github.com/vllm-project/vllm/security/advisories/GHSA-6pr9-rp53-2pmc x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/44970 x_refsource_MISC

---

vllm

• ==< 0.23.1rc0

Permalink CVE-2026-54232

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile

• https://github.com/vllm-project/vllm/security/advisories/GHSA-jrf6-vqxq-pjv2 x_refsource_CONFIRM

---

vllm

• ==< 0.22.1

Permalink CVE-2026-54235

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

• https://github.com/vllm-project/vllm/security/advisories/GHSA-7h4p-rffg-7823 x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/45116 x_refsource_MISC
• https://github.com/vllm-project/vllm/commit/d598d239737cfa37bcfcb98886ec3f3557fc7198 x_refsource_MISC

---

vllm

• ==< 0.23.1rc0

Permalink CVE-2026-47155

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors

• https://github.com/vllm-project/vllm/security/advisories/GHSA-3ww4-5jv9-j5gm x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/42616 x_refsource_MISC
• https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6 x_refsource_MISC
• https://huntr.com/bounties/3f1e24c0-87d2-4f6c-a705-820f380879ac x_refsource_MISC

---

vllm

• ==< 0.22.0

Permalink CVE-2026-54236

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

• https://github.com/vllm-project/vllm/security/advisories/GHSA-hgg8-fqqc-vfmw x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/pull/45119 x_refsource_MISC
• https://github.com/vllm-project/vllm/commit/94923629729381d7f7c9efde72071a2441f7fd82 x_refsource_MISC

---

vllm

• ==< 0.23.1rc0

Permalink CVE-2026-41523

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 11 hours ago by @LeSuisse Activity log

• Created suggestion 15 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 11 hours ago

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

• https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3 x_refsource_MISC
• https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c x_refsource_MISC

---

vllm

• ==< 0.22.0