NIXPKGS-2026-2064

GitHub issue published 5 hours ago

Gimp: gimp: double-free in read_layer_block()

Permalink CVE-2026-58381

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse ignored
  19 packages

  • gimp2
  • zigimports
  • gimpPlugins.gimp
  • gimpPlugins.gmic
  • gimp-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp3-with-plugins
  • gimp2Plugins.fourier
  • gimp2Plugins.farbfeld
  • gimpPlugins.lightning
  • gimp2Plugins.lightning
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.texturize
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

Gimp: gimp: double-free in read_layer_block()

• https://access.redhat.com/security/cve/CVE-2026-58381 x_refsource_REDHATvdb-entry
• RHBZ#2496166 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/gimp/-/commit/b22e147b
• https://gitlab.gnome.org/GNOME/gimp/-/issues/16207

---

gimp

gimp:2.8/gimp

Needs some backports or patches for stable

NIXPKGS-2026-2063

GitHub issue published 5 hours ago

Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment

Permalink CVE-2026-59093

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.weaviate-client
  • python314Packages.weaviate-client
  6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment

• Release Notes release-notes
• Fix PR issue-tracking
• Fix Commit patch
• https://www.vulncheck.com/advisories/weaviate-privilege-escalation-via-unchecke… third-party-advisory

---

weaviate

• <1.38.0

Needs some backports

NIXPKGS-2026-2062

GitHub issue published 5 hours ago

JuiceFS - Authentication Bypass via pprof and metrics Endpoints

Permalink CVE-2026-59092

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 22 hours ago
• @LeSuisse ignored reference https://w… 6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

JuiceFS - Authentication Bypass via pprof and metrics Endpoints

• GitHub Issue technical-description
• Fix PR issue-tracking
• Fix Commit patch

Ignored references (1)

• https://www.vulncheck.com/advisories/juicefs-authentication-bypass-via-pprof-an… third-party-advisory

---

juicefs

• ==a46979cdd4082217081ee99b931ddc53d038e47a
• =<1.3.1

NIXPKGS-2026-2061

GitHub issue published 5 hours ago

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

Permalink CVE-2026-58036

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 22 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.mediawiki-langcodes
  • python314Packages.mediawiki-langcodes
  6 hours ago
• @LeSuisse accepted 6 hours ago
• @LeSuisse published on GitHub 5 hours ago

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

• https://phabricator.wikimedia.org/T425406

---

MediaWiki

• <1.46.0

NIXPKGS-2026-2060

GitHub issue published 5 hours ago

Wasmtime: Leak in WASIp1 `fd_renumber` implementation

Permalink CVE-2026-54786

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 22 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.wasmtime
  • python314Packages.wasmtime
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Wasmtime: Leak in WASIp1 `fd_renumber` implementation

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3p27-qvp9-27qf x_refsource_CONFIRM

---

wasmtime

• ==>= 37.0.0, < 44.0.3
• ==>= 45.0.0, < 45.0.2
• ==< 24.0.10
• ==>= 25.0.0, < 36.0.11

NIXPKGS-2026-2059

GitHub issue published 5 hours ago

Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration

Permalink CVE-2026-58592

8.9 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 22 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration

• Proof of Concept exploit
• Affected source product
• VulnCheck Advisory: Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration third-party-advisory

---

Ladybird

• ==0

NIXPKGS-2026-2058

GitHub issue published 5 hours ago

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources

Permalink CVE-2026-56016

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 22 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources

• https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/changes release-notes
• https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/source/lib/CGI/Session/I… related
• http://www.openwall.com/lists/oss-security/2026/07/01/6

---

CGI-Session

• <4.49

NIXPKGS-2026-2057

GitHub issue published 5 hours ago

Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

Permalink CVE-2026-50160

10.0 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 22 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf x_refsource_CONFIRMexploit
• https://github.com/hoppscotch/hoppscotch/pull/6171 x_refsource_MISC
• http://www.openwall.com/lists/oss-security/2026/06/23/7

---

hoppscotch

• ==<= 2026.4.1

NIXPKGS-2026-2056

GitHub issue published 5 hours ago

Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()

Permalink CVE-2026-49119

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 22 hours ago
• @LeSuisse ignored
  8 packages

  • python312Packages.gradio-pdf
  • python313Packages.gradio-pdf
  • python314Packages.gradio-pdf
  • python312Packages.gradio-client
  • python313Packages.gradio-client
  • python314Packages.gradio-client
  • pkgsRocm.python3Packages.gradio-pdf
  • pkgsRocm.python3Packages.gradio-client
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()

• Release Notes release-notes
• Fix PR issue-tracking
• Fix Commit patch
• https://www.vulncheck.com/advisories/gradio-path-traversal-via-fileexplorer-pre… third-party-advisory

---

gradio

• <6.16.0

NIXPKGS-2026-2055

GitHub issue published 5 hours ago

runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

Permalink CVE-2026-41579

3.3 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 22 hours ago
• @LeSuisse ignored
  20 packages

  • nym
  • crunch
  • git-brunch
  • y-cruncher
  • speedcrunch
  • ocaml-crunch
  • untrunc-anthwlock
  • ocamlPackages.crunch
  • gnomeExtensions.runcat
  • haskellPackages.git-brunch
  • ocamlPackages_latest.crunch
  • perlPackages.StringTruncate
  • python312Packages.truncnorm
  • python313Packages.truncnorm
  • python314Packages.truncnorm
  • perl5Packages.StringTruncate
  • haskellPackages.html-truncate
  • perl538Packages.StringTruncate
  • perl540Packages.StringTruncate
  • vscode-extensions.42crunch.vscode-openapi
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

• https://github.com/opencontainers/runc/security/advisories/GHSA-xjvp-4fhw-gc47 x_refsource_CONFIRM
• https://github.com/opencontainers/runc/commit/864db8042dbb x_refsource_MISC

---

runc

• ==>= 1.4.0-rc.1, < 1.4.3
• ==< 1.3.6
• ==>= 1.5.0-rc.1, < 1.5.0-rc.3