NIXPKGS-2026-2363

GitHub issue published 9 hours ago

ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

Permalink CVE-2026-71260

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  8 packages

  • python313Packages.aioesphomeapi
  • python313Packages.bleak-esphome
  • python314Packages.aioesphomeapi
  • python314Packages.bleak-esphome
  • python313Packages.esphome-glyphsets
  • python314Packages.esphome-glyphsets
  • python313Packages.esphome-dashboard-api
  • python314Packages.esphome-dashboard-api
  9 hours ago
• @LeSuisse ignored reference https://g… 9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

• https://github.com/esphome/esphome/blob/dev/esphome/components/web_server/web_s…

Ignored references (1)

• https://github.com/esphome/esphome

---

esphome

• =<2026.7.0

NIXPKGS-2026-2362

GitHub issue published 9 hours ago

ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

Permalink CVE-2026-71259

8.6 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  8 packages

  • python313Packages.aioesphomeapi
  • python313Packages.bleak-esphome
  • python314Packages.aioesphomeapi
  • python314Packages.bleak-esphome
  • python313Packages.esphome-glyphsets
  • python314Packages.esphome-glyphsets
  • python313Packages.esphome-dashboard-api
  • python314Packages.esphome-dashboard-api
  9 hours ago
• @LeSuisse ignored reference https://g… 9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

• https://github.com/esphome/esphome/blob/dev/esphome/config_validation.py

Ignored references (1)

• https://github.com/esphome/esphome

---

esphome

• =<2026.7.0

NIXPKGS-2026-2361

GitHub issue published 9 hours ago

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Permalink CVE-2026-70606

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  23 packages

  • electron_42
  • electron_41
  • electron_43
  • electron-cash
  • electron-mail
  • electron-fiddle
  • electron_38
  • electron_38-bin
  • electron_39
  • electron_39-bin
  • electron_41-bin
  • electron_42-bin
  • electron_43-bin
  • todoist-electron
  • jitsi-meet-electron
  • electron-chromedriver
  • idrisPackages.electron
  • electron-chromedriver_38
  • electron-chromedriver_39
  • electron-chromedriver_40
  • electron-chromedriver_41
  • electron-chromedriver_42
  • electron-chromedriver_43
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

• https://github.com/electron/electron/security/advisories/GHSA-r4w5-6pfg-jxp5 x_refsource_CONFIRM

---

electron

• ==>= 41.0.0-alpha.1, < 41.9.1
• ==>= 43.0.0-alpha.1, < 43.0.0
• ==>= 40.0.0-alpha.1, < 40.10.6
• ==>= 42.0.0-alpha.1, < 42.5.1

NIXPKGS-2026-2360

GitHub issue published 9 hours ago

yeqifu warehouse FileController.java path traversal

Permalink CVE-2026-18903

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  3 references

  • CVE-2026-18903 | CVE Analysis and Report
  • VDB-385940 | CTI Indicators (IOB, IOC, …
  • Submit #859531 | GitHub warehouse V1.0 …
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

yeqifu warehouse FileController.java path traversal

• VDB-385940 | yeqifu warehouse FileController.java path traversal technical-descriptionvdb-entry
• https://fanatical-brain-9ba.notion.site/warehouse-381f1a573df48073ae69fd68e2c27… exploit

Ignored references (3)

• VDB-385940 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
• CVE-2026-18903 | CVE Analysis and Report third-party-advisory
• Submit #859531 | GitHub warehouse V1.0 Absolute Path Traversal third-party-advisory

---

warehouse

• ==aaf29962ba407d22d991781de28796ee7b4670e4

NIXPKGS-2026-2359

GitHub issue published 9 hours ago

Rpm: heap buffer overflow in ndb slot table parsing

Permalink CVE-2026-44605

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  16 packages

  • makerpm
  • rpm2targz
  • rpm-ostree
  • rpmextract
  • rpm-sequoia
  • perlPackages.RPM2
  • perl5Packages.RPM2
  • python313Packages.rpm
  • python314Packages.rpm
  • haskellPackages.rpm-nvr
  • haskellPackages.cabal-rpm
  • python313Packages.rpmfile
  • python314Packages.rpmfile
  • python313Packages.rpmfluff
  • python314Packages.rpmfluff
  • haskellPackages.select-rpms
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Rpm: heap buffer overflow in ndb slot table parsing

• RHSA-2026:33507 x_refsource_REDHATvendor-advisory
• https://access.redhat.com/security/cve/CVE-2026-44605 x_refsource_REDHATvdb-entry
• RHBZ#2482481 x_refsource_REDHATissue-tracking

---

rpm

rpm-main

• *

rust-bootupd

NIXPKGS-2026-2358

GitHub issue published 9 hours ago

Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook

Permalink CVE-2026-67623

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook

• Release Notes release-notes
• Researcher Disclosure exploit
• Pull Request (1)
• Pull Request (2)
• Patch Commit patch
• https://www.vulncheck.com/advisories/mistral-vibe-arbitrary-command-execution-v… third-party-advisory

---

mistral-vibe

• <2.23.3

Backport needed

NIXPKGS-2026-2357

GitHub issue published 9 hours ago

peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Permalink CVE-2026-71281

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

• https://github.com/huggingface/peft
• https://github.com/huggingface/peft/blob/main/src/peft/tuners/lora/corda.py

---

peft

• =<0.19.1

NIXPKGS-2026-2356

GitHub issue published 9 hours ago

mlflow: Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

Permalink CVE-2026-71211

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  7 packages

  • pkgsRocm.mlflow-server
  • mlflow-server
  • python313Packages.mlflow-tracing
  • pkgsRocm.python3Packages.sagemaker-mlflow
  • python314Packages.sagemaker-mlflow
  • python313Packages.sagemaker-mlflow
  • python314Packages.mlflow-tracing
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

mlflow: Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

• https://github.com/mlflow/mlflow/tree/v3.14.0/mlflow

---

mlflow

• =<3.14.0

Needs some backport to 26.05

NIXPKGS-2026-2355

GitHub issue published 9 hours ago

memos: security issues < 0.29.1 (backport needed)

Permalink CVE-2026-71272

8.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()

• https://github.com/usememos/memos
• https://github.com/usememos/memos/blob/main/internal/webhook/webhook.go

---

memos

• =<0.29.1

Needs backport

Permalink CVE-2026-71271

8.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

• https://github.com/usememos/memos
• https://github.com/usememos/memos/blob/main/internal/webhook/validate.go

---

memos

• =<0.29.1

NIXPKGS-2026-2354

GitHub issue published 9 hours ago

livebook: security issues < 0.19.9

Permalink CVE-2026-66297

5.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): High (H)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  3 packages

  • typstPackages.leetcode-livebook
  • typstPackages.leetcode-livebook_0_1_0
  • typstPackages.leetcode-livebook_0_1_1
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Unescaped deployment environment variables in generated setup commands

• https://github.com/livebook-dev/livebook/security/advisories/GHSA-qpjc-w5mm-73mj relatedvendor-advisory
• https://cna.erlef.org/cves/CVE-2026-66297.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-66297 related
• https://github.com/livebook-dev/livebook/commit/b2a8416d149043132fe5a14ed611e0f… patch
• https://github.com/livebook-dev/livebook/commit/0c2487326bbb37cb1eb43bb2f76eb93… patch
• https://github.com/livebook-dev/livebook/commit/f8fe9c62cb8bfc1dd0ccda4ea4a57c5… patch

---

livebook

• <0.19.9
• <0.18.7

livebook-dev/livebook

• <0.19.9-cuda12
• <0.18.7-cuda12
• <0.18.7
• *
• <0.19.9

Permalink CVE-2026-66885

6.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  3 packages

  • typstPackages.leetcode-livebook_0_1_1
  • typstPackages.leetcode-livebook_0_1_0
  • typstPackages.leetcode-livebook
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Livebook Teams identity callback lacks state binding, allowing login CSRF

• https://github.com/livebook-dev/livebook/security/advisories/GHSA-pvvw-28fw-c6fg relatedvendor-advisory
• https://cna.erlef.org/cves/CVE-2026-66885.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-66885 related
• https://github.com/livebook-dev/livebook/commit/21c16168263275541a6e076d0c31852… patch
• https://github.com/livebook-dev/livebook/commit/33a052daa386c4ce08a9c39a07fc90f… patch
• https://github.com/livebook-dev/livebook/commit/6ed2e213e9d5a19a70d7fcad5a8d616… patch

---

livebook

• <0.19.9
• <0.18.7

livebook-dev/livebook

• <0.19.9-cuda12
• <0.18.7-cuda12
• <0.18.7
• *
• <0.19.9

Permalink CVE-2026-68746

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  3 packages

  • typstPackages.leetcode-livebook
  • typstPackages.leetcode-livebook_0_1_0
  • typstPackages.leetcode-livebook_0_1_1
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access

• https://github.com/livebook-dev/livebook/security/advisories/GHSA-74j5-6grg-g6wj relatedvendor-advisory
• https://cna.erlef.org/cves/CVE-2026-68746.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-68746 related
• https://github.com/livebook-dev/livebook/commit/d374e90647edbb00286bfee9182c016… patch
• https://github.com/livebook-dev/livebook/commit/d6d0dfa746b172540442852f74de4a9… patch
• https://github.com/livebook-dev/livebook/commit/2d3a2c710c880abd24a2bc888d3cf52… patch

---

livebook

• <0.19.9

livebook-dev/livebook

• <0.19.9-cuda12
• <0.19.9
• *

Permalink CVE-2026-66881

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  3 packages

  • typstPackages.leetcode-livebook_0_1_1
  • typstPackages.leetcode-livebook_0_1_0
  • typstPackages.leetcode-livebook
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

• https://github.com/livebook-dev/livebook/security/advisories/GHSA-r4h8-2xpq-v48g relatedvendor-advisory
• https://cna.erlef.org/cves/CVE-2026-66881.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-66881 related
• https://github.com/livebook-dev/livebook/commit/1443dd23df6e7b9203b6797f0695a80… patch
• https://github.com/livebook-dev/livebook/commit/acf4cb8c0c79b89c795b180f061be7d… patch
• https://github.com/livebook-dev/livebook/commit/50f86982ebf36c22abeb379b55ec0f2… patch

---

livebook

• <0.19.9
• <0.18.7

livebook-dev/livebook

• <0.19.9-cuda12
• <0.18.7-cuda12
• <0.18.7
• *
• <0.19.9

Permalink CVE-2026-66298

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 9 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  3 packages

  • typstPackages.leetcode-livebook_0_1_1
  • typstPackages.leetcode-livebook_0_1_0
  • typstPackages.leetcode-livebook
  9 hours ago
• @LeSuisse accepted 9 hours ago
• @LeSuisse published on GitHub 9 hours ago

JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

• https://github.com/livebook-dev/livebook/security/advisories/GHSA-68c2-prqg-x62g relatedvendor-advisory
• https://cna.erlef.org/cves/CVE-2026-66298.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-66298 related
• https://github.com/livebook-dev/livebook/commit/296318ffdfa6e5ed7b18ad8d5a5b2af… patch
• https://github.com/livebook-dev/livebook/commit/a552ce8f99ad348ea37061394dc950a… patch
• https://github.com/livebook-dev/livebook/commit/5980e5c6b71036806b3bf54101eb1d6… patch

---

livebook

• <0.19.9
• <0.18.7

livebook-dev/livebook

• <0.19.9-cuda12
• <0.18.7-cuda12
• <0.18.7
• *
• <0.19.9