NIXPKGS-2026-2070

GitHub issue published 22 minutes ago

Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service

Permalink CVE-2026-14618

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 22 minutes ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored package open5gs-webui 24 minutes ago
• @LeSuisse ignored
  4 references

  • https://github.com/open5gs/open5gs/
  • Submit #844824 | Open5GS 2.7.7 Denial o…
  • CVE-2026-14618 | CVE Analysis and Report
  • VDB-376135 | CTI Indicators (IOB, IOC, …
  24 minutes ago
• @LeSuisse accepted 24 minutes ago
• @LeSuisse published on GitHub 22 minutes ago

Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service

• VDB-376135 | Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service vdb-entrytechnical-description
• https://github.com/open5gs/open5gs/issues/4517 issue-trackingexploit
• https://github.com/open5gs/open5gs/issues/4517#issuecomment-4589606265 issue-tracking
• https://github.com/ferrancanellas/open5gs/commit/fb5f67703de0213fb9c6e6ef3b48b6… patch

Ignored references (4)

• https://github.com/open5gs/open5gs/ product
• Submit #844824 | Open5GS 2.7.7 Denial of Service third-party-advisory
• CVE-2026-14618 | CVE Analysis and Report third-party-advisory
• VDB-376135 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required

---

Open5GS

• ==2.7.0
• ==2.7.3
• ==2.7.2
• ==2.7.4
• ==2.7.5
• ==2.7.1
• ==2.7.6
• ==2.7.7

NIXPKGS-2026-2069

GitHub issue published 22 minutes ago

Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()

Permalink CVE-2026-14535

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 22 minutes ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse accepted 23 minutes ago
• @LeSuisse published on GitHub 22 minutes ago

Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()

• GitHub Security Advisory GHSA-cffv-grgg-g429
• Fix PR #278 — Split shorten_code() formatting from dedup tracking, make MLAllowlist opt-in
• Fix commit 41ce7cb (squash merge of PR #278)
• Fickling v0.1.12 release

---

fickling

• =<0.1.11
• ==0.1.12

NIXPKGS-2026-2068

GitHub issue published 22 minutes ago

myVesta is affected by an authenticated remote code execution vulnerability. …

Permalink CVE-2026-12195

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 22 minutes ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored package vesta-viewer 23 minutes ago
• @LeSuisse accepted 23 minutes ago
• @LeSuisse published on GitHub 22 minutes ago

myVesta is affected by an authenticated remote code execution vulnerability. …

• https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422 patch
• https://projectblack.io/blog/local-ai-for-cyber-security/#myvesta-authenticated… exploit

---

vesta

• <95d7e43bf286d6881ca753dac93cb42d98cc7422

NIXPKGS-2026-2067

GitHub issue published 1 day, 7 hours ago

Hplip: incomplete fix for cve-2026-8631

Permalink CVE-2026-14544

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 13 hours ago
• @LeSuisse ignored package gnomeExtensions.alternate-menu-for-hplip2 1 day, 7 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

Hplip: incomplete fix for cve-2026-8631

• https://access.redhat.com/security/cve/CVE-2026-14544 vdb-entryx_refsource_REDHAT
• RHBZ#2496772 issue-trackingx_refsource_REDHAT

---

hplip

NIXPKGS-2026-2066

GitHub issue published 1 day, 7 hours ago

Gimp: gimp: heap buffer overflow in read_channel_data()

Permalink CVE-2026-58379

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 13 hours ago
• @LeSuisse ignored
  19 packages

  • gimp2
  • gimp-with-plugins
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.lightning
  • gimp2Plugins.texturize
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  • gimp2Plugins.farbfeld
  • gimp3-with-plugins
  • gimpPlugins.lightning
  • gimp2Plugins.fourier
  • gimpPlugins.gmic
  • gimpPlugins.gimp
  • zigimports
  1 day, 7 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

Gimp: gimp: heap buffer overflow in read_channel_data()

• https://access.redhat.com/security/cve/CVE-2026-58379 vdb-entryx_refsource_REDHAT
• RHBZ#2495997 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167
• https://gitlab.gnome.org/GNOME/gimp/-/issues/16205

---

gimp

gimp:2.8/gimp

NIXPKGS-2026-2065

GitHub issue published 1 day, 7 hours ago

assimp: security issues < 6.0.4

Permalink CVE-2026-14610

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 13 hours ago
• @LeSuisse ignored
  3 references

  • VDB-376118 | CTI Indicators (IOB, IOC, …
  • CVE-2026-14610 | CVE Analysis and Report
  • Submit #844646 | Assimp commit 17c12da …
  1 day, 7 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow

• VDB-376118 | Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow vdb-entrytechnical-description
• https://github.com/assimp/assimp/issues/6622 issue-tracking
• https://github.com/assimp/assimp/pull/6649 patchissue-tracking
• https://github.com/user-attachments/files/27235863/poc.zip exploit
• https://github.com/assimp/assimp/commit/eb84eec580d3f4ba2f0fd87409b7d0744620f11e patch

Ignored references (3)

• VDB-376118 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-14610 | CVE Analysis and Report third-party-advisory
• Submit #844646 | Assimp commit 17c12da Heap-based Buffer Overflow third-party-advisory

---

Assimp

• ==6.0.4
• ==6.0.1
• ==6.0.2
• ==6.0.0
• ==6.0.3
• ==6.0.5

Permalink CVE-2026-14604

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 day, 7 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 13 hours ago
• @LeSuisse ignored
  3 references

  • VDB-376112 | CTI Indicators (IOB, IOC, …
  • CVE-2026-14604 | CVE Analysis and Report
  • Submit #844567 | Assimp commit 17c12da …
  1 day, 7 hours ago
• @LeSuisse accepted 1 day, 7 hours ago
• @LeSuisse published on GitHub 1 day, 7 hours ago

Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free

• VDB-376112 | Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free vdb-entrytechnical-description
• https://github.com/assimp/assimp/issues/6620 issue-tracking
• https://github.com/user-attachments/files/27232640/poc.zip exploit

Ignored references (3)

• VDB-376112 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-14604 | CVE Analysis and Report third-party-advisory
• Submit #844567 | Assimp commit 17c12da Double Free third-party-advisory

---

Assimp

• ==6.0.4
• ==6.0.1
• ==6.0.2
• ==6.0.0
• ==6.0.3

NIXPKGS-2026-2064

GitHub issue published 1 day, 20 hours ago

Gimp: gimp: double-free in read_layer_block()

Permalink CVE-2026-58381

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 1 day, 20 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  19 packages

  • gimp2
  • zigimports
  • gimpPlugins.gimp
  • gimpPlugins.gmic
  • gimp-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp3-with-plugins
  • gimp2Plugins.fourier
  • gimp2Plugins.farbfeld
  • gimpPlugins.lightning
  • gimp2Plugins.lightning
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.texturize
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  1 day, 20 hours ago
• @LeSuisse accepted 1 day, 20 hours ago
• @LeSuisse published on GitHub 1 day, 20 hours ago

Gimp: gimp: double-free in read_layer_block()

• https://access.redhat.com/security/cve/CVE-2026-58381 x_refsource_REDHATvdb-entry
• RHBZ#2496166 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/gimp/-/commit/b22e147b
• https://gitlab.gnome.org/GNOME/gimp/-/issues/16207

---

gimp

gimp:2.8/gimp

Needs some backports or patches for stable

NIXPKGS-2026-2063

GitHub issue published 1 day, 20 hours ago

Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment

Permalink CVE-2026-59093

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 20 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.weaviate-client
  • python314Packages.weaviate-client
  1 day, 20 hours ago
• @LeSuisse accepted 1 day, 20 hours ago
• @LeSuisse published on GitHub 1 day, 20 hours ago

Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment

• Release Notes release-notes
• Fix PR issue-tracking
• Fix Commit patch
• https://www.vulncheck.com/advisories/weaviate-privilege-escalation-via-unchecke… third-party-advisory

---

weaviate

• <1.38.0

Needs some backports

NIXPKGS-2026-2062

GitHub issue published 1 day, 20 hours ago

JuiceFS - Authentication Bypass via pprof and metrics Endpoints

Permalink CVE-2026-59092

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 20 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored reference https://w… 1 day, 20 hours ago
• @LeSuisse accepted 1 day, 20 hours ago
• @LeSuisse published on GitHub 1 day, 20 hours ago

JuiceFS - Authentication Bypass via pprof and metrics Endpoints

• GitHub Issue technical-description
• Fix PR issue-tracking
• Fix Commit patch

Ignored references (1)

• https://www.vulncheck.com/advisories/juicefs-authentication-bypass-via-pprof-an… third-party-advisory

---

juicefs

• ==a46979cdd4082217081ee99b931ddc53d038e47a
• =<1.3.1

NIXPKGS-2026-2061

GitHub issue published 1 day, 20 hours ago

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

Permalink CVE-2026-58036

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 20 hours ago by @LeSuisse Activity log

• Created suggestion 3 days, 13 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.mediawiki-langcodes
  • python314Packages.mediawiki-langcodes
  1 day, 20 hours ago
• @LeSuisse accepted 1 day, 20 hours ago
• @LeSuisse published on GitHub 1 day, 20 hours ago

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

• https://phabricator.wikimedia.org/T425406

---

MediaWiki

• <1.46.0