NIXPKGS-2026-2534

GitHub issue published 10 hours ago

valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds

          Permalink
          
            CVE-2026-86227
          
        1.3 LOW
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): Low (L)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Exploit Maturity (E): POC (P)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): Low (L)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
              updated
            
          10 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          17 hours ago
          
          @LeSuisse
          
              ignored
            
                6 packages
                python313Packages.valkey
python314Packages.valkey
python313Packages.libvalkey
python314Packages.libvalkey
python313Packages.django-valkey
python314Packages.django-valkey

          13 hours ago
          
          @LeSuisse
          
              ignored
            
              reference https://g…
            
          13 hours ago
          
          @LeSuisse
          
              accepted
            
          13 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          10 hours ago
          
            valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds
          
      VDB-399380 | valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds
    
    technical-descriptionvdb-entry
  
      VDB-399380 | CTI Indicators (IOB, IOC, IOA)
    
    permissions-requiredsignature
  
      CVE-2026-86227 | CVE Analysis and Report
    
    third-party-advisory
  
      Submit #897659 | Valkey Project Valkey 9.1.0 Out-of-Bounds Read
    
    third-party-advisory
  
      https://github.com/valkey-io/valkey/issues/4222
    
    issue-tracking
  
      https://github.com/valkey-io/valkey/pull/4229
    
    issue-trackingpatch
  
      https://github.com/user-attachments/files/30195539/RDB.zip
    
    exploit
  
      https://github.com/valkey-io/valkey/commit/4691888e7fab3df128f0bde5750c9fde2ae5…
    
    patch
  
          Ignored references (1)
        
      https://github.com/valkey-io/valkey/
    
    product
  
    valkey

            ==9.1.0
          
            ==9.0.1
          
            ==9.0.2
          
            ==9.0.0
          
            ==9.1.1
          
            ==9.0.3
          
            ==9.0.5
          
            ==9.0.4

NIXPKGS-2026-2533

GitHub issue published 10 hours ago

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

          Permalink
          
            CVE-2026-86219
          
              updated
            
          10 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          17 hours ago
          
          @LeSuisse
          
              ignored
            
                2 packages
                perlPackages.AuthenSASLSASLprep
perl5Packages.AuthenSASLSASLprep

          13 hours ago
          
          @LeSuisse
          
              accepted
            
          13 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          10 hours ago
          
            Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step
          
      https://metacpan.org/release/EHUELS/Authen-SASL-2.2000/source/lib/Authen/SASL/P…
    
      https://metacpan.org/release/EHUELS/Authen-SASL-2.2000/source/lib/Authen/SASL/P…
    
      https://datatracker.ietf.org/doc/html/rfc2831#section-2.1.2
    
      https://github.com/perl-authen-sasl/perl-authen-sasl/commit/9433736703061284292…
    
    patch
  
      https://metacpan.org/release/EHUELS/Authen-SASL-2.2100/changes
    
    release-notes
  
      https://www.cve.org/CVERecord?id=CVE-2025-40918
    
    related
  
    Authen-SASL

            <2.2100

NIXPKGS-2026-2532

GitHub issue published 22 hours ago

SiYuan before v3.8.2 Private Attribute View Key Enumeration

Permalink CVE-2026-86191

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 22 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse accepted 1 day, 9 hours ago
@LeSuisse ignored
3 maintainers
- @TomaSajt
- @mtul0729
- @L-Trump
22 hours ago maintainer.ignore
@LeSuisse published on GitHub 22 hours ago

SiYuan before v3.8.2 Private Attribute View Key Enumeration

GitHub Security Advisory (GHSA-j4qq-w6qx-6839) vendor-advisory
VulnCheck Advisory: SiYuan before v3.8.2 Private Attribute View Key Enumeration third-party-advisory

siyuan

<3.8.2
==3.8.2

NIXPKGS-2026-2531

GitHub issue published 22 hours ago

Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

Permalink CVE-2026-86197

5.1 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 22 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse ignored
19 packages
- haskellPackages.gravatar
- gravit
- antigravity
- antigravity-cli
- antigravity-fhs
- antigravity-ide
- antigravity-ide-fhs
- stardust-xr-gravity
- kdePackages.libgravatar
- bulwark-plugins.gravatar
- gnomeExtensions.gravatar
- python313Packages.libgravatar
- python314Packages.libgravatar
- python314Packages.flask-gravatar
- python313Packages.django-gravatar2
- python313Packages.flask-gravatar
- python314Packages.django-gravatar2
- perlPackages.MojoliciousPluginGravatar
- perl5Packages.MojoliciousPluginGravatar
1 day, 9 hours ago
@LeSuisse accepted 1 day, 9 hours ago
@LeSuisse published on GitHub 22 hours ago

Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

GitHub Security Advisory (GHSA-8hgv-xc77-jmcr) vendor-advisory
VulnCheck Advisory: Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox third-party-advisory

grav

<2.0.20
==2.0.20

NIXPKGS-2026-2530

GitHub issue published 22 hours ago

NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

          Permalink
          
            CVE-2026-86175
          
        7.1 HIGH
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): High (H)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): High (H)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          22 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 17 hours ago
          
          @LeSuisse
          
              ignored
            
                63 packages
                netbox2netshot
pkgsRocm.netbox
pkgsRocm.netbox_4_4
netboxPlugins.netbox-bgp
netboxPlugins.netbox-dns
netboxPlugins.netbox-lists
python313Packages.pynetbox
python314Packages.pynetbox
netboxPlugins.netbox-qrcode
netboxPlugins.netbox-routing
netboxPlugins.netbox-secrets
python313Packages.netbox-bgp
python314Packages.netbox-bgp
python314Packages.netbox-dns
netboxPlugins.netbox-contract
netboxPlugins.netbox-security
netboxPlugins.netbox-documents
netboxPlugins.netbox-inventory
netboxPlugins.netbox-lifecycle
netboxPlugins.netbox-data-flows
python314Packages.netbox-qrcode
netboxPlugins.netbox-attachments
python313Packages.netbox-routing
python314Packages.netbox-routing
netboxPlugins.netbox-contextmenus
terraform-providers.e-breuninger_netbox
python313Packages.netbox-dns
python313Packages.netbox-qrcode
netboxPlugins.netbox-reorder-rack
python313Packages.netbox-contract
netboxPlugins.netbox-config-backup
netboxPlugins.netbox-napalm-plugin
python313Packages.netbox-documents
python314Packages.netbox-documents
netboxPlugins.netbox-custom-objects
netboxPlugins.netbox-topology-views
pkgsRocm.python3Packages.netbox-bgp
python313Packages.netbox-attachments
netboxPlugins.netbox-floorplan-plugin
python313Packages.netbox-contextmenus
python313Packages.netbox-reorder-rack
python314Packages.netbox-contextmenus
python314Packages.netbox-reorder-rack
pkgsRocm.python3Packages.netbox-qrcode
python313Packages.netbox-napalm-plugin
pkgsRocm.python3Packages.netbox-routing
python313Packages.netbox-topology-views
pkgsRocm.python3Packages.netbox-contract
netboxPlugins.netbox-plugin-prometheus-sd
pkgsRocm.python3Packages.netbox-documents
python313Packages.netbox-floorplan-plugin
pkgsRocm.python3Packages.netbox-attachments
pkgsRocm.python3Packages.netbox-reorder-rack
pkgsRocm.python3Packages.netbox-napalm-plugin
python313Packages.netbox-plugin-prometheus-sd
python314Packages.netbox-plugin-prometheus-sd
netboxPlugins.netbox-interface-synchronization
pkgsRocm.python3Packages.netbox-topology-views
pkgsRocm.python3Packages.netbox-floorplan-plugin
python313Packages.netbox-interface-synchronization
python314Packages.netbox-interface-synchronization
pkgsRocm.python3Packages.netbox-plugin-prometheus-sd
pkgsRocm.python3Packages.netbox-interface-synchronization

          22 hours ago
          
          @LeSuisse
          
              restored
            
              package pkgsRocm.netbox_4_4
            
          22 hours ago
          
          @LeSuisse
          
              accepted
            
          22 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          22 hours ago
          
            NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
          
      Researcher Advisory
    
    third-party-advisoryexploit
  
      DataSourceSerializer Meta.fields
    
    technical-description
  
      DataSourceType GraphQL fields
    
    technical-description
  
      GitBackend sensitive_parameters
    
    technical-description
  
      GitHub Issue #12625
    
    issue-tracking
  
      https://github.com/netbox-community/netbox
    
    product
  
      VulnCheck Advisory: NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
    
    third-party-advisory
  
    netbox

            =<4.7.0

NIXPKGS-2026-2529

GitHub issue published 22 hours ago

Pixelfed through 0.12.9 Unauthorized Story Access via API

          Permalink
          
            CVE-2026-86178
          
        5.3 MEDIUM
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): Low (L)
        
          Vulnerable System Impact Integrity (VI): Low (L)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
        
          Modified Vulnerable System Impact Integrity (MVI): Low (L)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          22 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 17 hours ago
          
          @LeSuisse
          
              accepted
            
          22 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          22 hours ago
          
            Pixelfed through 0.12.9 Unauthorized Story Access via API
          
      Researcher Advisory
    
    third-party-advisoryexploit
  
      StoryComposeController react
    
    technical-description
  
      StoryComposeController comment
    
    technical-description
  
      Story react and comment routes
    
    technical-description
  
      https://github.com/pixelfed/pixelfed
    
    product
  
      VulnCheck Advisory: Pixelfed through 0.12.9 Unauthorized Story Access via API
    
    third-party-advisory
  
    pixelfed

            =<0.12.9

NIXPKGS-2026-2528

GitHub issue published 22 hours ago

gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

          Permalink
          
            CVE-2026-86118
          
        5.3 MEDIUM
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): Low (L)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): Low (L)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          22 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 17 hours ago
          
          @LeSuisse
          
              accepted
            
          22 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          22 hours ago
          
            gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
          
      GitHub Security Advisory (GHSA-453r-pgfw-h3pq)
    
    vendor-advisory
  
      ServeStartScan without an admin check
    
    technical-description
  
      /startScan registered on the plain auth chain
    
    technical-description
  
      gonic v0.22.0 Release Notes
    
    release-notes
  
      https://github.com/sentriz/gonic
    
    product
  
      VulnCheck Advisory: gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
    
    third-party-advisory
  
    gonic

            <0.22.0
          
            Needs a backport.

NIXPKGS-2026-2527

GitHub issue published 22 hours ago

Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

          Permalink
          
            CVE-2026-86116
          
        7.1 HIGH
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): High (H)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): High (H)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          22 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 17 hours ago
          
          @LeSuisse
          
              accepted
            
          22 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          22 hours ago
          
            Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
          
      Researcher write-up
    
    technical-description
  
      Glossary POST/PUT/DELETE with no authorization check
    
    technical-description
  
      Restrict glossary permissions (#76275)
    
    patch
  
      metabase v0.63.1 Release Notes
    
    release-notes
  
      https://github.com/metabase/metabase
    
    product
  
      VulnCheck Advisory: Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
    
    third-party-advisory
  
    metabase

            <0.63.1
          
            Needs a backport

NIXPKGS-2026-2526

GitHub issue published 22 hours ago

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse …

Permalink CVE-2026-86145

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 22 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse ignored
12 packages
- jpcre2
- ocamlPackages.pcre2
- haskellPackages.pcre2
- luaPackages.lrexlib-pcre2
- ocamlPackages_latest.pcre2
- haskellPackages.regex-pcre2
- lua51Packages.lrexlib-pcre2
- lua52Packages.lrexlib-pcre2
- lua53Packages.lrexlib-pcre2
- lua54Packages.lrexlib-pcre2
- lua55Packages.lrexlib-pcre2
- luajitPackages.lrexlib-pcre2
1 day, 3 hours ago
@LeSuisse accepted 22 hours ago
@LeSuisse published on GitHub 22 hours ago

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse …

PCRE2

<10.48

NIXPKGS-2026-2525

GitHub issue published 1 day, 9 hours ago

libpcap: security issues < 1.10.7

Permalink CVE-2026-31911

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 1 day, 9 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python313Packages.libpcap
- python314Packages.libpcap
1 day, 9 hours ago
@LeSuisse accepted 1 day, 9 hours ago
@LeSuisse published on GitHub 1 day, 9 hours ago

abort() in libpcap before 1.10.7 on an invalid BPF opcode

https://github.com/the-tcpdump-group/libpcap/commit/a715bcdde830299cba417151438… patch

libpcap

<1.10.7

Permalink CVE-2026-0799

8.7 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 day, 9 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python313Packages.libpcap
- python314Packages.libpcap
1 day, 9 hours ago
@LeSuisse accepted 1 day, 9 hours ago
@LeSuisse published on GitHub 1 day, 9 hours ago

OOBR and OOBW in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e… patch

libpcap

<1.10.7

Permalink CVE-2026-18238

5.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python314Packages.libpcap
- python313Packages.libpcap
1 day, 9 hours ago
@LeSuisse accepted 1 day, 9 hours ago
@LeSuisse published on GitHub 1 day, 9 hours ago

OOBR in rpcap client in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae… patch

libpcap

<1.10.7
==1.9.x
==1.8.x

Permalink CVE-2026-6554

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 1 day, 9 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python313Packages.libpcap
- python314Packages.libpcap
1 day, 9 hours ago
@LeSuisse accepted 1 day, 9 hours ago
@LeSuisse published on GitHub 1 day, 9 hours ago

infinte loop in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b… patch

libpcap

<1.10.7

Permalink CVE-2026-31912

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 1 day, 9 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python313Packages.libpcap
- python314Packages.libpcap
1 day, 9 hours ago
@LeSuisse accepted 1 day, 9 hours ago
@LeSuisse published on GitHub 1 day, 9 hours ago

OOBR in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e… patch

libpcap

<1.10.7

Permalink CVE-2026-6244

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 1 day, 9 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse ignored
3 packages
- python314Packages.libpcap
- python313Packages.libpcap
- darwin.libpcap
1 day, 9 hours ago
@LeSuisse accepted 1 day, 9 hours ago
@LeSuisse published on GitHub 1 day, 9 hours ago

division by zero in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/98bb921b141aa642faedbf2ac51… patch

libpcap

<1.10.7

Permalink CVE-2026-18313

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 1 day, 9 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python313Packages.libpcap
- python314Packages.libpcap
1 day, 9 hours ago
@LeSuisse accepted 1 day, 9 hours ago
@LeSuisse published on GitHub 1 day, 9 hours ago

rpcapd memory leak in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/f9775af1a0ec76db60c7213241e… patch

libpcap

<1.10.7
==1.9.x

Nixpkgs security tracker

Published issues

valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

SiYuan before v3.8.2 Private Attribute View Key Enumeration

Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

Pixelfed through 0.12.9 Unauthorized Story Access via API

gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse …

abort() in libpcap before 1.10.7 on an invalid BPF opcode

OOBR and OOBW in libpcap before 1.10.7

OOBR in rpcap client in libpcap before 1.10.7

infinte loop in libpcap before 1.10.7

OOBR in libpcap before 1.10.7

division by zero in libpcap before 1.10.7

rpcapd memory leak in libpcap before 1.10.7