NIXPKGS-2026-2170

GitHub issue published 5 hours ago

Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size

Permalink CVE-2026-15551

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored package libsForQt5.rlottie-qml 6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size

• https://github.com/Samsung/rlottie/pull/595

---

rlottie

• ==bf689b72b8482c5ea674235854bd11b6d1b42588

Patch: https://github.com/Samsung/rlottie/commit/f487eff2f8086b84ae1c7faa0418abec909e874b

NIXPKGS-2026-2169

GitHub issue published 5 hours ago

Blender 3.0.0 - 5.1.2 Out-of-Bounds Read via crafted .blend SDNA block

Permalink CVE-2026-60103

6.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

Blender 3.0.0 - 5.1.2 Out-of-Bounds Read via crafted .blend SDNA block

• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/blender-out-of-bounds-read-via-crafted-ble… third-party-advisory

---

blender

• ==968972a918b5ed2d534295b639c54449d7de11cd
• =<5.1.2

NIXPKGS-2026-2168

GitHub issue published 5 hours ago

AnyDesk Support Information Link Following Denial-of-Service Vulnerability

Permalink CVE-2026-15682

4.7 MEDIUM

• CVSS version (CVSS): 3.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

AnyDesk Support Information Link Following Denial-of-Service Vulnerability

• ZDI-26-401 x_research-advisory

---

AnyDesk

• ==9.0.4

NIXPKGS-2026-2167

GitHub issue published 5 hours ago

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability

Permalink CVE-2026-15681

4.7 MEDIUM

• CVSS version (CVSS): 3.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability

• ZDI-26-400 x_research-advisory

---

AnyDesk

• ==9.0.4

NIXPKGS-2026-2166

GitHub issue published 5 hours ago

GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow

Permalink CVE-2026-15520

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  4 references

  • https://www.gnu.org/
  • Submit #851190 | LibreDWG 0.13.4-154-g0…
  • CVE-2026-15520 | CVE Analysis and Report
  • VDB-377849 | CTI Indicators (IOB, IOC, …
  6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow

• VDB-377849 | GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow technical-descriptionvdb-entry
• https://github.com/LibreDWG/libredwg/issues/1251 issue-trackingexploit
• https://github.com/advisories/GHSA-qg2f-8389-w95j issue-trackingbroken-link
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_0b57303_heap… exploit
• https://github.com/LibreDWG/libredwg/commit/3d0f9fc2eddbd6579c99af3111c37c98f03… patch
• https://github.com/LibreDWG/libredwg/releases/tag/0.14.8396 patch

Ignored references (4)

• https://www.gnu.org/ productbroken-link
• Submit #851190 | LibreDWG 0.13.4-154-g0b573035 (main branch, commit 0b573035, 2026-04-29) 内存损坏 (Heap Buffer Overflow - Write) third-party-advisory
• CVE-2026-15520 | CVE Analysis and Report third-party-advisory
• VDB-377849 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required

---

LibreDWG

• ==0.13.4-154-g0b573035
• ==0.14.8396

NIXPKGS-2026-2165

GitHub issue published 5 hours ago

filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete

Permalink CVE-2026-61874

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  3 packages

  • filebrowser-quantum
  • python313Packages.filebrowser-safe
  • python314Packages.filebrowser-safe
  6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete

• GitHub Security Advisory (GHSA-pp88-jhwj-5qh5) vendor-advisory
• https://github.com/filebrowser/filebrowser/commit/be23ab3a15bf957928ecfed88de5ab67850c1b9c patch
• VulnCheck Advisory: filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete third-party-advisory

---

filebrowser

• <2.63.17
• ==2.63.17

NIXPKGS-2026-2164

GitHub issue published 5 hours ago

Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__

Permalink CVE-2026-61454

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  16 packages

  • gravit
  • antigravity
  • antigravity-cli
  • antigravity-fhs
  • stardust-xr-gravity
  • kdePackages.libgravatar
  • gnomeExtensions.gravatar
  • haskellPackages.gravatar
  • python313Packages.libgravatar
  • python314Packages.libgravatar
  • python313Packages.flask-gravatar
  • python314Packages.flask-gravatar
  • python313Packages.django-gravatar2
  • python314Packages.django-gravatar2
  • perlPackages.MojoliciousPluginGravatar
  • perl5Packages.MojoliciousPluginGravatar
  6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__

• GitHub Security Advisory (GHSA-pfjq-chp8-3vgh) vendor-advisory
• VulnCheck Advisory: Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__ third-party-advisory

---

grav

• ==2.0.4
• <2.0.4

NIXPKGS-2026-2163

GitHub issue published 5 hours ago

Out-of-bound read in mtr

Permalink CVE-2026-14461

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  22 packages

  • mtrace
  • gomtree
  • memtree
  • mtr-gui
  • nmtrust
  • rmtrash
  • vgmtrans
  • hamtransfer
  • mtr-exporter
  • schismtracker
  • nltk-data.comtrans
  • typstPackages.mtret
  • dockapps.wmsystemtray
  • ocamlPackages.memtrace
  • haskellPackages.paramtree
  • haskellPackages.simtreelo
  • typstPackages.mtret_0_1_0
  • python313Packages.pykmtronic
  • python314Packages.pykmtronic
  • ocamlPackages_latest.memtrace
  • python313Packages.iterative-telemetry
  • python314Packages.iterative-telemetry
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Out-of-bound read in mtr

• https://cert.pl/en/posts/2026/07/CVE-2026-14461 third-party-advisory
• https://github.com/traviscross/mtr/commit/48e1794414d338ce47abc0f27c25ade8788af… patch

---

mtr

• =<0.96

NIXPKGS-2026-2162

GitHub issue published 5 hours ago

Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

Permalink CVE-2026-59151

9.6 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

• https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp x_refsource_CONFIRM
• https://github.com/prowler-cloud/prowler/pull/11650 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e x_refsource_MISC
• https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/releases/tag/5.30.3 x_refsource_MISC

---

prowler

• ==< 5.30.3

Needs a port to stable.

NIXPKGS-2026-2161

GitHub issue published 5 hours ago

RustDesk before 1.4.9 Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection

Permalink CVE-2026-57850

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  2 packages

  • rustdesk-server
  • rustdesk-flutter
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

RustDesk before 1.4.9 Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection

• Fix Pull Request #15469 issue-tracking
• Patch Commit patch
• RustDesk 1.4.9 Release release-notes
• Product product

---

RustDesk

• <1.4.9