NIXPKGS-2026-2822

GitHub issue published 30 minutes ago

dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal

Permalink CVE-2026-101067

5.5 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 30 minutes ago by @LeSuisse Activity log

• Created suggestion 3 hours ago
• @LeSuisse accepted 58 minutes ago
• @LeSuisse published on GitHub 30 minutes ago

dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal

• VDB-410925 | dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal technical-descriptionvdb-entry
• VDB-410925 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
• CVE-2026-101067 | CVE Analysis and Report third-party-advisory
• Submit #929029 | dbgate <= 7.2.5 Path Traversal third-party-advisory
• https://github.com/0xGenesi/CVE/blob/main/dbgate_save_uploaded_file_path_traver… exploit

---

dbgate

• ==6.8.1
• ==7.1.5
• ==7.2.3
• ==7.1.8
• ==7.2.2
• ==7.3.1
• ==7.1.1
• ==7.1.7
• ==7.1.3
• ==7.1.0
• ==7.0.1
• ==7.0.2
• ==7.0.0
• ==7.1.4
• ==7.1.2
• ==7.3.0
• ==6.8.0
• ==7.2.0
• ==7.1.6
• ==7.2.5
• ==7.2.4
• ==7.2.1

NIXPKGS-2026-2821

GitHub issue published 31 minutes ago

dbgate Export databaseConnections.js exportModelSql path traversal

Permalink CVE-2026-101069

5.5 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 31 minutes ago by @LeSuisse Activity log

• Created suggestion 3 hours ago
• @LeSuisse accepted 58 minutes ago
• @LeSuisse published on GitHub 31 minutes ago

dbgate Export databaseConnections.js exportModelSql path traversal

• VDB-410927 | dbgate Export databaseConnections.js exportModelSql path traversal technical-descriptionvdb-entry
• VDB-410927 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
• CVE-2026-101069 | CVE Analysis and Report third-party-advisory
• Submit #929034 | dbgate <= 7.2.5 Path Traversal third-party-advisory
• https://github.com/0xGenesi/CVE/blob/main/dbgate_export_model_sql_arbitrary_wri… exploit

---

dbgate

• ==7.3.1
• ==7.3.0

NIXPKGS-2026-2820

GitHub issue published 31 minutes ago

dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal

Permalink CVE-2026-101068

5.5 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 31 minutes ago by @LeSuisse Activity log

• Created suggestion 3 hours ago
• @LeSuisse accepted 58 minutes ago
• @LeSuisse published on GitHub 31 minutes ago

dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal

• VDB-410926 | dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal technical-descriptionvdb-entry
• VDB-410926 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
• CVE-2026-101068 | CVE Analysis and Report third-party-advisory
• Submit #929031 | dbgate <= 7.2.5 Path Traversal third-party-advisory
• https://github.com/0xGenesi/CVE/blob/main/dbgate_config_zip_arbitrary_write.md exploit

---

dbgate

• ==7.3.1
• ==7.3.0

NIXPKGS-2026-2819

GitHub issue published 31 minutes ago

Unsloth Zoo Code Injection via model_type in config.json

Permalink CVE-2026-93348

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 31 minutes ago by @LeSuisse Activity log

• Created suggestion 3 hours ago
• @LeSuisse ignored package unsloth-desktop 57 minutes ago
• @LeSuisse accepted 57 minutes ago
• @LeSuisse published on GitHub 31 minutes ago

Unsloth Zoo Code Injection via model_type in config.json

• Pull Request (1) issue-trackingpatch
• Pull Request (2) issue-trackingpatch
• Unsloth Zoo Dependency Bump patch
• https://www.vulncheck.com/advisories/unsloth-zoo-code-injection-via-model-type-… third-party-advisory

---

unsloth

• <2026.8.20

unsloth-zoo

• <2026.8.14

NIXPKGS-2026-2818

GitHub issue published 31 minutes ago

InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

Permalink CVE-2026-100392

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 31 minutes ago by @LeSuisse Activity log

• Created suggestion 3 hours ago
• @LeSuisse accepted 57 minutes ago
• @LeSuisse published on GitHub 31 minutes ago

InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

• https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-4fxw-x7wr-x6qc x_refsource_CONFIRM

---

InvoicePlane

• === 1.7.2

NIXPKGS-2026-2817

GitHub issue published 31 minutes ago

Containerd has image-pull DoS via crafted OCI index graph amplification

Permalink CVE-2026-53493

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 31 minutes ago by @LeSuisse Activity log

• Created suggestion 3 hours ago
• @LeSuisse ignored package nomad-driver-containerd 56 minutes ago
• @LeSuisse accepted 56 minutes ago
• @LeSuisse published on GitHub 31 minutes ago

Containerd has image-pull DoS via crafted OCI index graph amplification

• https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645 x_refsource_CONFIRM

---

containerd

• ==>= 2.1.0, < 2.2.9
• ==>= 2.3.0, < 2.3.6
• ==< 1.7.36
• === 2.4.0
• ==>= 2.0.0, < 2.0.13

NIXPKGS-2026-2816

GitHub issue published 31 minutes ago

LiteLLM Weak JWT Authentication via Email-Based User Lookup

Permalink CVE-2026-93355

7.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 31 minutes ago by @LeSuisse Activity log

• Created suggestion 3 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.unclecode-litellm
  • python314Packages.unclecode-litellm
  50 minutes ago
• @LeSuisse accepted 50 minutes ago
• @LeSuisse published on GitHub 31 minutes ago

LiteLLM Weak JWT Authentication via Email-Based User Lookup

• OXsecurity Blog exploittechnical-description
• https://www.vulncheck.com/advisories/litellm-weak-jwt-authentication-via-email-… third-party-advisory

---

litellm

• =<f4308bc124eebc783dfc51790ce8db27ed21ae00
• =<1.102.1

NIXPKGS-2026-2815

GitHub issue published 31 minutes ago

Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one

Permalink CVE-2026-101014

5.5 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 31 minutes ago by @LeSuisse Activity log

• Created suggestion 3 hours ago
• @LeSuisse accepted 50 minutes ago
• @LeSuisse published on GitHub 31 minutes ago

Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one

• VDB-410884 | Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one technical-descriptionvdb-entry
• VDB-410884 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-101014 | CVE Analysis and Report third-party-advisory
• Submit #917100 | The Trusted Domain Project OpenDMARC 1.4.2 Out-of-Bounds Read third-party-advisory
• https://github.com/trusteddomainproject/OpenDMARC/pull/188 issue-trackingpatch
• https://github.com/trusteddomainproject/OpenDMARC/pull/344 issue-trackingpatch
• https://weitongli.com/share/opendmarc-cleanup-off-by-one.html exploit
• https://github.com/trusteddomainproject/OpenDMARC/commit/b3b1da9264bc80324094a2… patch

---

OpenDMARC

• ==1.4.1
• ==1.4.2
• ==1.4.0

NIXPKGS-2026-2814

GitHub issue published 31 minutes ago

Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition

Permalink CVE-2026-101017

5.5 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 31 minutes ago by @LeSuisse Activity log

• Created suggestion 3 hours ago
• @LeSuisse accepted 49 minutes ago
• @LeSuisse published on GitHub 31 minutes ago

Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition

• VDB-410887 | Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition technical-descriptionvdb-entry
• VDB-410887 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-101017 | CVE Analysis and Report third-party-advisory
• Submit #918247 | The Trusted Domain Project OpenDMARC 1.4.2 Improper Authentication third-party-advisory
• https://xuyongzhe-vt.github.io/share/opendmarc-subdomain-walk-abort.html exploit

---

OpenDMARC

• ==1.4.1
• ==1.4.2
• ==1.4.0

NIXPKGS-2026-2813

GitHub issue published 31 minutes ago

InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

Permalink CVE-2026-100371

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 31 minutes ago by @LeSuisse Activity log

• Created suggestion 3 hours ago
• @LeSuisse accepted 48 minutes ago
• @LeSuisse published on GitHub 31 minutes ago

InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

• https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-77hm-22wp-96wp x_refsource_CONFIRM
• https://github.com/InvoicePlane/InvoicePlane/pull/1638 x_refsource_MISC
• https://github.com/InvoicePlane/InvoicePlane/commit/8616fa45a61c1694b55bb9116e293269a0ced06a x_refsource_MISC

---

InvoicePlane

• === 1.7.2