NIXPKGS-2026-2715

GitHub issue published 6 hours ago

ntopng: security issues < 6.7.260718

Permalink CVE-2026-83621

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs

• https://github.com/ntop/ntopng/security/advisories/GHSA-ffg5-889g-f5q8 x_refsource_CONFIRM
• https://github.com/ntop/ntopng/commit/1d0627d802c59130c82478a4eb7f14014064eae5 x_refsource_MISC
• https://github.com/ntop/ntopng/commit/669589fe208fc932fe40a840e0de8e4d9df6023f x_refsource_MISC

---

ntopng

• ==< 6.7.260717

Permalink CVE-2026-82412

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API

• https://github.com/ntop/ntopng/security/advisories/GHSA-2c6p-4pfj-qv58 x_refsource_CONFIRM
• https://github.com/ntop/ntopng/commit/0d3156274f4d12db8b61432ebeded10966c01f3e x_refsource_MISC
• https://github.com/ntop/ntopng/commit/771b34a9d37f5de989eec4f2f8f2e852db1c7e5e x_refsource_MISC
• https://github.com/ntop/ntopng/commit/838ccd523a3d4a71b29a62f7653e572a1ffa5cf6 x_refsource_MISC
• https://github.com/ntop/ntopng/commit/9f42a12251d881e3a20ebd667c1a2e6a6570c270 x_refsource_MISC

---

ntopng

• ==< 6.7.260717

Permalink CVE-2026-84990

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse accepted 7 hours ago
• @LeSuisse published on GitHub 6 hours ago

ntopng: Missing Authorization on System Configuration Backup Download and Listing

• https://github.com/ntop/ntopng/security/advisories/GHSA-7gqc-vjwr-6rh5 x_refsource_CONFIRM
• https://github.com/ntop/ntopng/commit/f912ee93bc143330b6ff3bb946ee7211e5ee9e1a x_refsource_MISC

---

ntopng

• ==< 6.7.260718

NIXPKGS-2026-2714

GitHub issue published 6 hours ago

libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow

Permalink CVE-2026-88807

8.9 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse accepted 7 hours ago
• @LeSuisse published on GitHub 6 hours ago

libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow

• https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19 patch

---

libXrender

• <0.9.13

NIXPKGS-2026-2713

GitHub issue published 6 hours ago

vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

Permalink CVE-2026-94622

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse accepted 7 hours ago
• @LeSuisse published on GitHub 6 hours ago

vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

• Pull Request #54807 patchissue-tracking
• https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/… technical-description
• https://github.com/vllm-project/vllm product
• VulnCheck Advisory: vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata third-party-advisory

---

vllm

• =<0.29.0

Upstream PR still open

NIXPKGS-2026-2712

GitHub issue published 6 hours ago

BleachBit: Exploit File Delete to Escalate Privilege

Permalink CVE-2026-55567

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse accepted 7 hours ago
• @LeSuisse published on GitHub 6 hours ago

BleachBit: Exploit File Delete to Escalate Privilege

• https://github.com/bleachbit/bleachbit/security/advisories/GHSA-vcjw-px28-5w94 exploitx_refsource_CONFIRM
• https://github.com/bleachbit/bleachbit/pull/1774 x_refsource_MISC
• https://github.com/bleachbit/bleachbit/commit/ee128238e92c7192f0c4d6406b1bd0cd9155e7e0 x_refsource_MISC
• https://github.com/bleachbit/bleachbit/releases/tag/v6.0.1 x_refsource_MISC

---

bleachbit

• ==< 6.0.1

Needs something for stable

NIXPKGS-2026-2711

GitHub issue published 6 hours ago

drogonframework drogon ORM Criteria.cc makeCriteria sql injection

Permalink CVE-2026-94144

5.5 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse ignored reference https://g… 7 hours ago
• @LeSuisse accepted 7 hours ago
• @LeSuisse published on GitHub 6 hours ago

drogonframework drogon ORM Criteria.cc makeCriteria sql injection

• VDB-408059 | drogonframework drogon ORM Criteria.cc makeCriteria sql injection technical-descriptionvdb-entry
• VDB-408059 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• CVE-2026-94144 | CVE Analysis and Report third-party-advisory
• Submit #893929 | drogonframework drogon 1.9.13 SQL Injection third-party-advisory
• https://github.com/drogonframework/drogon/issues/2576 issue-tracking
• https://gist.github.com/2H-K/bf8328f70f72196545b0d9589367cb6a exploit

Ignored references (1)

• https://github.com/drogonframework/drogon/ product

---

drogon

• ==1.9.7
• ==1.9.4
• ==1.9.11
• ==1.9.2
• ==1.9.5
• ==1.9.8
• ==1.9.10
• ==1.9.1
• ==1.9.0
• ==1.9.12
• ==1.9.3
• ==1.9.6
• ==1.9.13
• ==1.9.9

NIXPKGS-2026-2710

GitHub issue published 6 hours ago

Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

Permalink CVE-2026-94184

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse ignored package fetchmail_7 7 hours ago
• @LeSuisse accepted 7 hours ago
• @LeSuisse published on GitHub 6 hours ago

Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

• https://access.redhat.com/security/cve/CVE-2026-94184 vdb-entryx_refsource_REDHAT
• RHBZ#2537395 issue-trackingx_refsource_REDHAT
• https://gitlab.com/fetchmail/fetchmail/-/commit/cb5be5c38471eec19e519ace0bc5691…
• https://www.fetchmail.info/fetchmail-SA-2026-01.txt
• https://www.openwall.com/lists/oss-security/2026/06/27/8

---

fetchmail

Needs port to stable

NIXPKGS-2026-2709

GitHub issue published 6 hours ago

Cri-o: cri-o checkpoint restore bypasses destination security context

Permalink CVE-2026-92574

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse ignored
  2 packages

  • conmon
  • conmon-rs
  7 hours ago
• @LeSuisse accepted 7 hours ago
• @LeSuisse published on GitHub 6 hours ago

Cri-o: cri-o checkpoint restore bypasses destination security context

• https://access.redhat.com/security/cve/CVE-2026-92574 vdb-entryx_refsource_REDHAT
• RHBZ#2535436 issue-trackingx_refsource_REDHAT

---

cri-o

conmon

kata-containers

openshift4/cnf-tests-rhel8

openshift/ose-rhel-coreos-8

openshift/ose-rhel-coreos-9

container-tools:rhel8/conmon

container-tools:rhel8/podman

ose-crio-credential-provider

openshift4/microshift-bootc-rhel9

openshift4/microshift-bootc-rhel10

openshift4/ztp-site-generate-rhel8

openshift-sandboxed-containers/osc-monitor-rhel9

Fix in 1.36.0 (and maybe 1.37.1?)

NIXPKGS-2026-2708

GitHub issue published 6 hours ago

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Permalink CVE-2026-59168

6.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

• https://github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq x_refsource_CONFIRM
• https://github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68 x_refsource_MISC
• https://github.com/TomWright/dasel/releases/tag/v3.11.1 x_refsource_MISC

---

dasel

• ==>= 3.0.0, < 3.11.1

Needs a backport

NIXPKGS-2026-2707

GitHub issue published 6 hours ago

Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler

Permalink CVE-2026-61674

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler

• https://github.com/fluent/fluent-bit/security/advisories/GHSA-jrp8-r9hx-gf73 exploitx_refsource_CONFIRM
• https://github.com/fluent/fluent-bit/pull/11945 x_refsource_MISC
• https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0 x_refsource_MISC
• https://github.com/fluent/fluent-bit/releases/tag/v5.0.8 x_refsource_MISC

---

fluent-bit

• ==>= 0.11.0, < 5.0.8

Needs a backport

NIXPKGS-2026-2706

GitHub issue published 6 hours ago

libX11 XkbGetMap Reply Heap-based Buffer Overflow

Permalink CVE-2026-88806

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 hours ago by @LeSuisse Activity log

• Created suggestion 10 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 6 hours ago

libX11 XkbGetMap Reply Heap-based Buffer Overflow

• https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309 patch

---

libX11

• <1.8.14