NIXPKGS-2026-2684

GitHub issue published 11 hours ago

Out-of-bounds write in GraphicsMagick PCD decoder

Permalink CVE-2026-77118

8.4 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 11 hours ago by @mdaniels5757 Activity log

Created suggestion 4 weeks, 2 days ago
@mdaniels5757 accepted 11 hours ago
@mdaniels5757 published on GitHub 11 hours ago

Out-of-bounds write in GraphicsMagick PCD decoder

Upstream fix (released in 1.3.48) patch
GraphicsMagick 1.3.48 ChangeLog entry describing the fix and crediting the reporter release-notes

GraphicsMagick

<1.3.48

graphicsmagick

<1.4+really1.3.48-1

NIXPKGS-2026-2683

GitHub issue published 17 hours ago

exim: security issues < 4.100.1

Permalink CVE-2026-94054

7.0 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 17 hours ago by @LeSuisse Activity log

Created suggestion 23 hours ago
@LeSuisse accepted 17 hours ago
@LeSuisse published on GitHub 17 hours ago

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled …

https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html

Exim

<4.100.1

Permalink CVE-2026-94055

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 17 hours ago by @LeSuisse Activity log

Created suggestion 23 hours ago
@LeSuisse accepted 17 hours ago
@LeSuisse published on GitHub 17 hours ago

Exim before 4.100.1, when certain non-default TLS settings are used …

https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html

Exim

<4.100.1

Permalink CVE-2026-94057

4.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 17 hours ago by @LeSuisse Activity log

Created suggestion 23 hours ago
@LeSuisse accepted 17 hours ago
@LeSuisse published on GitHub 17 hours ago

Exim before 4.100.1 allows SMTP smuggling in which the received …

https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html

Exim

<4.100.1

Permalink CVE-2026-94056

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 17 hours ago by @LeSuisse Activity log

Created suggestion 23 hours ago
@LeSuisse accepted 17 hours ago
@LeSuisse published on GitHub 17 hours ago

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled …

https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html

Exim

<4.100.1

NIXPKGS-2026-2682

GitHub issue published 1 day, 15 hours ago

Out of bounds write in PDP ctx GSN-Address decode

Permalink CVE-2026-75892

updated 1 day, 15 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 23 hours ago
@LeSuisse accepted 1 day, 16 hours ago
@LeSuisse published on GitHub 1 day, 15 hours ago

Out of bounds write in PDP ctx GSN-Address decode

https://cgit.osmocom.org/osmo-ggsn/commit/?id=6c322f4dd339401a437da3c89c95f2bf6… patchmitigation

osmo-ggsn

==1.14.0

NIXPKGS-2026-2681

GitHub issue published 1 day, 15 hours ago

Mealie before 3.21.0 Information Disclosure via Ratings Endpoint

          Permalink
          
            CVE-2026-93736
          
        5.3 MEDIUM
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): Low (L)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          1 day, 15 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 23 hours ago
          
          @Scrumplex
          
              ignored
            
                2 packages
                python313Packages.aiomealie
python314Packages.aiomealie

          1 day, 17 hours ago
          
          @Scrumplex
          
              accepted
            
          1 day, 17 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          1 day, 15 hours ago
          
            Mealie before 3.21.0 Information Disclosure via Ratings Endpoint
          
      GitHub Issue #7909
    
    exploitissue-tracking
  
      https://github.com/mealie-recipes/mealie
    
    product
  
      https://github.com/mealie-recipes/mealie/blob/v3.20.1/mealie/routes/users/ratin…
    
    technical-description
  
      https://github.com/mealie-recipes/mealie/blob/v3.20.1/mealie/repos/repository_u…
    
    technical-description
  
      https://github.com/mealie-recipes/mealie/pull/7903
    
    patchissue-tracking
  
      https://github.com/mealie-recipes/mealie/commit/6889101a760a457019276c10514e630…
    
    patch
  
      mealie v3.21.0 Release Notes
    
    release-notes
  
      VulnCheck Advisory: Mealie before 3.21.0 Information Disclosure via Ratings Endpoint
    
    third-party-advisory
  
    mealie

            <3.21.0

NIXPKGS-2026-2680

GitHub issue published 1 day, 15 hours ago

PPPD buffer overflow in PEAP response code

Permalink CVE-2026-75883

6.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Adjacent (A)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Adjacent (A)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 1 day, 15 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 23 hours ago
@Scrumplex ignored
9 packages
- luppp
- rpPPPoE
- rp-pppoe
- perlPackages.DevelPPPort
- python313Packages.xmpppy
- python314Packages.xmpppy
- perl5Packages.DevelPPPort
- perlPackages.ModuleBuildPluggablePPPort
- perl5Packages.ModuleBuildPluggablePPPort
1 day, 17 hours ago
@Scrumplex accepted 1 day, 17 hours ago
@LeSuisse published on GitHub 1 day, 15 hours ago

PPPD buffer overflow in PEAP response code

https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35 vendor-advisory

ppp

==2.5.4
=<2.5.0

NIXPKGS-2026-2679

GitHub issue published 1 day, 15 hours ago

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Permalink CVE-2026-75157

updated 1 day, 15 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 23 hours ago
@LeSuisse accepted 1 day, 16 hours ago
@LeSuisse published on GitHub 1 day, 15 hours ago

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

apache-airflow

<3.3.2

NIXPKGS-2026-2678

GitHub issue published 1 day, 15 hours ago

Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

          Permalink
          
            CVE-2026-32641
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          1 day, 15 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 23 hours ago
          
          @LeSuisse
          
              accepted
            
          1 day, 16 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          1 day, 15 hours ago
          
            Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware
          
      https://github.com/parseablehq/parseable/security/advisories/GHSA-x4q9-j9qh-3rpx
    
    x_refsource_CONFIRM
  
      https://github.com/parseablehq/parseable/pull/1581
    
    x_refsource_MISC
  
      https://github.com/parseablehq/parseable/commit/6c583081a4161476128f330b9bb71ed7305eecde
    
    x_refsource_MISC
  
      https://github.com/parseablehq/parseable/releases/tag/v3.0.0
    
    x_refsource_MISC
  
    parseable

            ==< 3.0.0

NIXPKGS-2026-2677

GitHub issue published 1 day, 15 hours ago

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

          Permalink
          
            CVE-2026-58197
          
        8.8 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Adjacent (A)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Adjacent (A)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          1 day, 15 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 23 hours ago
          
          @LeSuisse
          
              accepted
            
          1 day, 16 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          1 day, 15 hours ago
          
            ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
          
      https://github.com/stacklok/toolhive/security/advisories/GHSA-qg2g-g9w3-m5h8
    
    x_refsource_CONFIRMexploit
  
      https://github.com/stacklok/toolhive-studio/pull/2469
    
    x_refsource_MISC
  
      https://github.com/stacklok/toolhive/pull/5583
    
    x_refsource_MISC
  
      https://github.com/stacklok/toolhive-studio/commit/968182d7f3ee1e55123369e66ad88f82128119b0
    
    x_refsource_MISC
  
      https://github.com/stacklok/toolhive/commit/d8f40cb1599b8bf66657f2dfff15bfbfc236e712
    
    x_refsource_MISC
  
      https://github.com/stacklok/toolhive-studio/releases/tag/v0.38.0
    
    x_refsource_MISC
  
      https://github.com/stacklok/toolhive/releases/tag/v0.30.1
    
    x_refsource_MISC
  
    toolhive

            ==< 0.30.1
          
    toolhive-studio

            ==< 0.38.0
          
            Needs a backport

NIXPKGS-2026-2676

GitHub issue published 1 day, 15 hours ago

Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks

          Permalink
          
            CVE-2026-93676
          
        3.2 LOW
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 day, 15 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 23 hours ago
          
          @LeSuisse
          
              accepted
            
          1 day, 16 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          1 day, 15 hours ago
          
            Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks
          
      https://access.redhat.com/security/cve/CVE-2026-93676
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2537014
    
    x_refsource_REDHATissue-tracking
  
    xdg-dbus-proxy

            https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-r7hp-698j-2h6c

NIXPKGS-2026-2675

GitHub issue published 1 day, 15 hours ago

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

          Permalink
          
            CVE-2026-77339
          
        5.1 MEDIUM
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): Present (P)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Passive (P)
        
          Vulnerable System Impact Confidentiality (VC): Low (L)
        
          Vulnerable System Impact Integrity (VI): Low (L)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): Low (L)
        
          Subsequent System Impact Integrity (SI): High (H)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): Present (P)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Passive (P)
        
          Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
        
          Modified Vulnerable System Impact Integrity (MVI): Low (L)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Low (L)
        
          Modified Subsequent System Impact Integrity (MSI): High (H)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          1 day, 15 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 23 hours ago
          
          @LeSuisse
          
              accepted
            
          1 day, 16 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          1 day, 15 hours ago
          
            Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools
          
      https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v
    
    x_refsource_CONFIRMexploit
  
      https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858
    
    x_refsource_MISC
  
      https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0
    
    x_refsource_MISC
  
    process-compose

            ==< 1.120.0

Nixpkgs security tracker

Published issues

Out-of-bounds write in GraphicsMagick PCD decoder

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled …

Exim before 4.100.1, when certain non-default TLS settings are used …

Exim before 4.100.1 allows SMTP smuggling in which the received …

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled …

Out of bounds write in PDP ctx GSN-Address decode

Mealie before 3.21.0 Information Disclosure via Ratings Endpoint

PPPD buffer overflow in PEAP response code

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools