NIXPKGS-2026-2141

GitHub issue published 1 day, 1 hour ago

Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries

Permalink CVE-2026-59269

3.8 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries

• https://github.com/vmware/pinniped/security/advisories/GHSA-7xq8-m6h6-2xg8

---

Pinniped

• =<0.46.0

NIXPKGS-2026-2140

GitHub issue published 1 day, 1 hour ago

GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds

Permalink CVE-2026-15185

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse ignored
  4 references

  • VDB-377111 | CTI Indicators (IOB, IOC, …
  • CVE-2026-15185 | CVE Analysis and Report
  • Submit #851214 | GPAC GPAC 26.03-DEV Ou…
  • https://github.com/gpac/gpac/
  1 day, 3 hours ago
• @LeSuisse ignored
  32 packages

  • msgpack-cxx
  • msgpack-c
  • msgpack-tools
  • rubyPackages.msgpack
  • phpExtensions.msgpack
  • haskellPackages.msgpack
  • perlPackages.MsgPackRaw
  • php82Extensions.msgpack
  • php83Extensions.msgpack
  • php84Extensions.msgpack
  • php85Extensions.msgpack
  • luaPackages.lua-cmsgpack
  • perl5Packages.MsgPackRaw
  • rubyPackages_3_3.msgpack
  • rubyPackages_3_4.msgpack
  • rubyPackages_4_0.msgpack
  • python313Packages.msgpack
  • python314Packages.msgpack
  • lua51Packages.lua-cmsgpack
  • lua52Packages.lua-cmsgpack
  • lua53Packages.lua-cmsgpack
  • lua54Packages.lua-cmsgpack
  • lua55Packages.lua-cmsgpack
  • python313Packages.ormsgpack
  • python314Packages.ormsgpack
  • haskellPackages.data-msgpack
  • python313Packages.msgpack-numpy
  • python314Packages.msgpack-numpy
  • haskellPackages.data-msgpack-types
  • python313Packages.u-msgpack-python
  • python314Packages.u-msgpack-python
  • chickenPackages_5.chickenEggs.msgpack
  1 day, 3 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds

• VDB-377111 | GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds vdb-entrytechnical-description
• https://github.com/gpac/gpac/issues/3611 exploitissue-tracking
• https://github.com/gpac/gpac/commit/aa0fb77b82e51b159a2024c440cdf6b571b14d81 patch
• https://github.com/gpac/gpac/commit/532097084729a936bcdf6a27c41003f3bd7dc3ff patch

Ignored references (4)

• VDB-377111 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-15185 | CVE Analysis and Report third-party-advisory
• Submit #851214 | GPAC GPAC 26.03-DEV Out-of-Bounds Read third-party-advisory
• https://github.com/gpac/gpac/ product

---

GPAC

• ==26.03-DEV

NIXPKGS-2026-2139

GitHub issue published 1 day, 1 hour ago

gpsd gpsprof Command Injection via gnuplot plot title subtype field

Permalink CVE-2026-58459

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse ignored package indi-3rdparty.indi-gpsd 1 day, 3 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

gpsd gpsprof Command Injection via gnuplot plot title subtype field

• https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267 issue-tracking
• Patch Commit (1) patch
• Patch Commit (2) patch
• Patch Commit (3) patch
• https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot… third-party-advisory

---

gpsd

• =<3.27.5
• =<4c06658e988f4ced1a7a574ce082a22ef625df56

NIXPKGS-2026-2138

GitHub issue published 1 day, 1 hour ago

Open5GS AMF context.c amf_context_final use after free

Permalink CVE-2026-15194

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse ignored package open5gs-webui 1 day, 3 hours ago
• @LeSuisse ignored
  3 references

  • https://github.com/open5gs/open5gs/
  • CVE-2026-15194 | CVE Analysis and Report
  • VDB-377122 | CTI Indicators (IOB, IOC, …
  1 day, 3 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

Open5GS AMF context.c amf_context_final use after free

• VDB-377122 | Open5GS AMF context.c amf_context_final use after free vdb-entrytechnical-description
• Submit #851630 | Open5GS Project Open5GS 2.7.7 Use After Free third-party-advisory
• https://github.com/open5gs/open5gs/security/advisories/GHSA-88pq-hpwv-2vjw exploit

Ignored references (3)

• https://github.com/open5gs/open5gs/ product
• CVE-2026-15194 | CVE Analysis and Report third-party-advisory
• VDB-377122 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature

---

Open5GS

• ==2.7.7

NIXPKGS-2026-2137

GitHub issue published 1 day, 1 hour ago

Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Permalink CVE-2026-59149

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

• https://github.com/mockoon/mockoon/security/advisories/GHSA-8wqc-v2q8-vff2 exploitx_refsource_CONFIRM
• https://github.com/mockoon/mockoon/pull/2255 x_refsource_MISC
• https://github.com/mockoon/mockoon/commit/b42bdfb7f82e83f0e81bea8e6fe41adf5ec82585 x_refsource_MISC
• https://github.com/mockoon/mockoon/releases/tag/v9.7.0 x_refsource_MISC
• https://mockoon.com/releases/9.7.0 x_refsource_MISC

---

mockoon

• ==< 9.7.0

NIXPKGS-2026-2136

GitHub issue published 1 day, 1 hour ago

Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

Permalink CVE-2026-59826

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

Metabase: Arbitrary Code Execution via Database Connection Detail Bypass

• https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35 x_refsource_CONFIRM
• https://github.com/metabase/metabase/commit/74032e5e0a5a70dc45a6a744d37b9ba24eee8d01 x_refsource_MISC
• https://github.com/metabase/metabase/releases/tag/v0.58.15.1 x_refsource_MISC
• https://github.com/metabase/metabase/releases/tag/v0.59.12 x_refsource_MISC
• https://github.com/metabase/metabase/releases/tag/v0.60.6.3 x_refsource_MISC
• https://github.com/metabase/metabase/releases/tag/v0.61.2 x_refsource_MISC

---

metabase

• ==>= 1.61.0, < 1.61.2
• ==>= 1.60.0, < 1.60.6.3
• ==>= 1.55.0, < 1.58.15.1
• ==>= 1.59.0, < 1.59.12

NIXPKGS-2026-2135

GitHub issue published 1 day, 1 hour ago

zeek: security issues < 8.0.9

Permalink CVE-2026-60108

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse ignored
  6 packages

  • zeekstd
  • zeekscript
  • python313Packages.zeek
  • python314Packages.zeek
  • python313Packages.tree-sitter-zeek
  • python314Packages.tree-sitter-zeek
  1 day, 1 hour ago
• @LeSuisse accepted 1 day, 1 hour ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

Zeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzer

• Release Notes release-notes
• Patch Commit patch
• https://www.vulncheck.com/advisories/zeek-uncontrolled-memory-consumption-dos-v… third-party-advisory

---

zeek

• <8.0.9

Permalink CVE-2026-60109

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse ignored
  6 packages

  • zeekstd
  • zeekscript
  • python313Packages.zeek
  • python314Packages.zeek
  • python313Packages.tree-sitter-zeek
  • python314Packages.tree-sitter-zeek
  1 day, 1 hour ago
• @LeSuisse accepted 1 day, 1 hour ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

Zeek < 8.0.9 Null Pointer Dereference DoS via Kerberos KRB_ERROR Parsing

• Release Notes release-notes
• Patch Commit patch
• https://www.vulncheck.com/advisories/zeek-null-pointer-dereference-dos-via-kerb… third-party-advisory

---

zeek

• <8.0.9

NIXPKGS-2026-2134

GitHub issue published 1 day, 3 hours ago

bosh-cli: security issues < 7.10.4

Permalink CVE-2026-47828

8.9 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 3 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 3 hours ago

Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay

• https://www.cloudfoundry.org/blog/cve-2026-47828-missing-tls-certificate-verifi…

---

bosh-cli

• <7.10.4

Permalink CVE-2026-47829

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 3 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 3 hours ago

Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director

• https://www.cloudfoundry.org/blog/cve-2026-47829-argument-injection-in-bosh-cli…

---

bosh-cli

• <7.10.4

NIXPKGS-2026-2133

GitHub issue published 1 day, 3 hours ago

openfga: security issues < 1.18.0

Permalink CVE-2026-55689

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 day, 3 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse ignored
  3 packages

  • openfga-cli
  • python313Packages.openfga-sdk
  • python314Packages.openfga-sdk
  1 day, 3 hours ago
• @LeSuisse ignored
  2 references

  • https://github.com/openfga/helm-ch
  • https://github.com/openfga/helm-charts/…
  1 day, 3 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 3 hours ago

OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

• https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv x_refsource_CONFIRM
• https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271 x_refsource_MISC
• https://github.com/openfga/openfga/releases/tag/v1.18.0 x_refsource_MISC

Ignored references (2)

• https://github.com/openfga/helm-ch x_refsource_MISC
• https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9 x_refsource_MISC

---

openfga

• ==< 1.18.0

Needs some backports to stable

Permalink CVE-2026-55170

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 3 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse ignored
  3 packages

  • openfga-cli
  • python313Packages.openfga-sdk
  • python314Packages.openfga-sdk
  1 day, 3 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 3 hours ago

OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

• https://github.com/openfga/openfga/security/advisories/GHSA-cf98-j28v-49v6 x_refsource_CONFIRM
• https://github.com/openfga/helm-charts/commit/96d5517a2693ff5def451dee7d6b9d1baeb281f8 x_refsource_MISC
• https://github.com/openfga/openfga/commit/a2e0dbefc3e01a95c785f81a3563bc6571b08b11 x_refsource_MISC
• https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9 x_refsource_MISC
• https://github.com/openfga/openfga/releases/tag/v1.18.0 x_refsource_MISC

---

openfga

• ==< 1.18.0

Needs some backports to stable

NIXPKGS-2026-2132

GitHub issue published 1 day, 3 hours ago

hoppscotch: security issues < 2026.6.0

Permalink CVE-2026-59721

7.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 day, 3 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 3 hours ago

Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-v7q6-r45w-2c6r exploitx_refsource_CONFIRM
• https://github.com/hoppscotch/hoppscotch/pull/6413 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/commit/73a88c82b1b2cada26cc4b2bc095b54554242239 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0 x_refsource_MISC

---

hoppscotch

• ==< 2026.6.0

Permalink CVE-2026-59720

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 3 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 11 hours ago
• @LeSuisse accepted 1 day, 3 hours ago
• @LeSuisse published on GitHub 1 day, 3 hours ago

Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server

• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-c68f-wr5p-j6jf exploitx_refsource_CONFIRM
• https://github.com/hoppscotch/hoppscotch/pull/6410 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/commit/e4332110d455a3012d5c77a9186bc4aa096e34f2 x_refsource_MISC
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0 x_refsource_MISC

---

hoppscotch

• ==< 2026.6.0