NIXPKGS-2026-1930

GitHub issue published 8 hours ago

OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration

Permalink CVE-2026-48709

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 8 hours ago

OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration

• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-f637-w7p2-m7fx x_refsource_CONFIRM
• https://github.com/OliveTin/OliveTin/releases/tag/3000.13.0 x_refsource_MISC

---

OliveTin

• ==< 3000.13.0

NIXPKGS-2026-1929

GitHub issue published 8 hours ago

OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

Permalink CVE-2026-48708

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 8 hours ago

OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-7fq5-7wr8-rjwj x_refsource_CONFIRM
• https://github.com/OliveTin/OliveTin/releases/tag/3000.13.0 x_refsource_MISC

---

OliveTin

• ==< 3000.13.0

NIXPKGS-2026-1928

GitHub issue published 8 hours ago

Valhalla has reflected XSS via unsanitized JSONP callback parameter

Permalink CVE-2026-49294

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 8 hours ago

Valhalla has reflected XSS via unsanitized JSONP callback parameter

• https://github.com/valhalla/valhalla/security/advisories/GHSA-85xx-39j8-r56x x_refsource_CONFIRMexploit

---

valhalla

• ==<= 3.6.3

NIXPKGS-2026-1927

GitHub issue published 8 hours ago

DbGate: Remote Code Execution via functionName injection in loadReader endpoint

Permalink CVE-2026-48017

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 8 hours ago

DbGate: Remote Code Execution via functionName injection in loadReader endpoint

• https://github.com/dbgate/dbgate/security/advisories/GHSA-hv83-ggc4-v385 x_refsource_CONFIRM
• https://github.com/dbgate/dbgate/releases/tag/v7.1.9 x_refsource_MISC

---

dbgate

• ==< 7.1.9

NIXPKGS-2026-1926

GitHub issue published 8 hours ago

WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability

Permalink CVE-2026-39463

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  8 packages

  • python314Packages.uvicorn-worker
  • python313Packages.uvicorn-worker
  • buildbotPackages.buildbot-worker
  • haskellPackages.orderly-workers
  • haskellPackages.Spock-worker
  • buildbot-worker
  • worker
  • worker-build
  11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 8 hours ago

WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability

• https://patchstack.com/database/wordpress/plugin/worker/vulnerability/wordpress… vdb-entry

---

worker

• =<4.9.31

NIXPKGS-2026-1925

GitHub issue published 8 hours ago

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery

Permalink CVE-2026-12205

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 8 hours ago

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery

• https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/source/lib/Crypt/DSA.pm#L47
• https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.21/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/06/15/4

---

Crypt-DSA

• <1.21

NIXPKGS-2026-1924

GitHub issue published 8 hours ago

Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

Permalink CVE-2026-47261

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.wasmtime
  • python314Packages.wasmtime
  11 hours ago
• @LeSuisse ignored
  3 references

  • https://github.com/bytecodealliance/was…
  • https://github.com/bytecodealliance/was…
  • https://github.com/bytecodealliance/was…
  11 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 8 hours ago

Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2r75-cxrj-cmph x_refsource_CONFIRM
• https://github.com/bytecodealliance/wasmtime/releases/tag/v44.0.2 x_refsource_MISC

Ignored references (3)

• https://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.0 x_refsource_MISC
• https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.10 x_refsource_MISC
• https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.9 x_refsource_MISC

---

wasmtime

• ==< 24.0.9
• ==>= 37.0.0, < 44.0.2
• ==>= 25.0.0, < 36.0.10

NIXPKGS-2026-1923

GitHub issue published 8 hours ago

WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability

Permalink CVE-2026-48835

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 8 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 11 hours ago
• @LeSuisse published on GitHub 8 hours ago

WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability

• https://patchstack.com/database/wordpress/plugin/wpforms-lite/vulnerability/wor… vdb-entry

---

wpforms-lite

• =<1.10.0.4

NIXPKGS-2026-1922

GitHub issue published 1 day, 9 hours ago

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in …

Permalink CVE-2026-54411

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Automatable (AU): No (N)
• Value Density (V): Diffuse (D)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Recovery (R): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored
  2 references

  • CWE-208: Observable Timing Discrepancy
  • Linux-PAM - upstream repository
  1 day, 9 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in …

• Vulnerable plaintext-password comparison in pam_userdb.c (master) product
• pam_consttime_streq helper available for the remediation product

Ignored references (2)

• CWE-208: Observable Timing Discrepancy technical-description
• Linux-PAM - upstream repository product

---

Linux-PAM

• =<1.7.2

NIXPKGS-2026-1921

GitHub issue published 1 day, 9 hours ago

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle

Permalink CVE-2026-11527

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle

• https://github.com/shlomif/perl-Config-IniFiles/commit/3e48f9627fbba4dae5de35be… patch
• https://metacpan.org/release/SHLOMIF/Config-IniFiles-3.001000/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/06/14/5

---

Config-IniFiles

• <3.001000