NIXPKGS-2026-1881

GitHub issue published 4 hours ago

USCiLab Cereal Shared Pointer type confusion

Permalink CVE-2026-11463

2.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 13 hours ago
• @LeSuisse ignored
  16 packages

  • haskellPackages.cereal
  • haskellPackages.cereal-unordered-containers
  • haskellPackages.cereal-conduit
  • typstPackages.cereal-words_0_1_0
  • haskellPackages.safe-money-cereal
  • haskellPackages.histogram-fill-cereal
  • haskellPackages.mpi-hs-cereal
  • haskellPackages.leb128-cereal
  • haskellPackages.exinst-cereal
  • haskellPackages.domain-cereal
  • haskellPackages.genvalidity-hspec-cereal
  • haskellPackages.cereal-vector
  • haskellPackages.cereal-time
  • haskellPackages.cereal-text
  • pkgsRocm.haskellPackages.mpi-hs-cereal
  • typstPackages.cereal-words
  4 hours ago
• @LeSuisse ignored
  4 references

  • https://github.com/USCiLab/cereal/
  • CVE-2026-11463 | CVE Analysis and Report
  • Submit #814456 | USCiLab cereal 1.3.2 C…
  • VDB-369083 | CTI Indicators (IOB, IOC)
  4 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

USCiLab Cereal Shared Pointer type confusion

• VDB-369083 | USCiLab Cereal Shared Pointer type confusion vdb-entry
• https://github.com/USCiLab/cereal/issues/870 issue-tracking
• https://gist.github.com/TrebledJ/0223c1fa3c3fd64e2c7047b8a4385ec0 exploit

Ignored references (4)

• https://github.com/USCiLab/cereal/ product
• CVE-2026-11463 | CVE Analysis and Report third-party-advisory
• Submit #814456 | USCiLab cereal 1.3.2 CWE-1287, CWE-843 (Type Confusion) third-party-advisory
• VDB-369083 | CTI Indicators (IOB, IOC) permissions-requiredsignature

---

Cereal

• ==1.3.0
• ==1.3.1
• ==1.3.2

NIXPKGS-2026-1880

GitHub issue published 4 hours ago

Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a HTTP/2 Bomb

Permalink CVE-2026-10725

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 13 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a HTTP/2 Bomb

• https://metacpan.org/release/CRUX/Protocol-HTTP2-1.12/source/lib/Protocol/HTTP2…
• https://metacpan.org/release/CRUX/Protocol-HTTP2-1.12/source/lib/Protocol/HTTP2…
• https://security.metacpan.org/patches/P/Protocol-HTTP2/1.12/CVE-2026-10725-r1.p… patch
• http://www.openwall.com/lists/oss-security/2026/06/06/7

---

Protocol-HTTP2

• =<1.12

NIXPKGS-2026-1879

GitHub issue published 2 days, 7 hours ago

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds …

Permalink CVE-2026-50593

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 days, 7 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  8 packages

  • graphite
  • graphite-cursors
  • graphite-gtk-theme
  • prometheus-graphite-exporter
  • python314Packages.graphite-web
  • python313Packages.graphite-web
  • haskellPackages.graphite
  • graphite-cli
  2 days, 7 hours ago
• @LeSuisse accepted 2 days, 7 hours ago
• @LeSuisse published on GitHub 2 days, 7 hours ago

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds …

• https://github.com/silnrsi/graphite/commit/ad78c6b7319909e1540c1b134e115ced0341…
• https://github.com/silnrsi/graphite/compare/1.3.14...1.3.15

---

Graphite

• <1.3.15

NIXPKGS-2026-1878

GitHub issue published 2 days, 7 hours ago

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

Permalink CVE-2026-45409

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 days, 7 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 13 hours ago
• @LeSuisse ignored
  4 packages

  • sbclPackages.idna
  • echidna
  • kodiPackages.idna
  • unicode-idna
  2 days, 7 hours ago
• @LeSuisse accepted 2 days, 7 hours ago
• @LeSuisse published on GitHub 2 days, 7 hours ago

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

• https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx x_refsource_CONFIRM

---

idna

• ==< 3.15

NIXPKGS-2026-1877

GitHub issue published 3 days, 7 hours ago

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Permalink CVE-2026-47707

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 3 days, 7 hours ago by @LeSuisse Activity log

• Created suggestion 3 days, 12 hours ago
• @LeSuisse ignored
  3 packages

  • strawberry
  • python313Packages.strawberry-django
  • pkgsRocm.python3Packages.strawberry-django
  3 days, 8 hours ago
• @LeSuisse accepted 3 days, 8 hours ago
• @LeSuisse published on GitHub 3 days, 7 hours ago

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

• https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfc x_refsource_CONFIRMexploit
• https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7 x_refsource_MISC

---

strawberry

• ==>= 0.172.0, < 0.315.7

NIXPKGS-2026-1876

GitHub issue published 3 days, 7 hours ago

Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread …

Permalink CVE-2026-10305

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 3 days, 7 hours ago by @LeSuisse Activity log

• Created suggestion 3 days, 12 hours ago
• @LeSuisse ignored package libsForQt5.rlottie-qml 3 days, 8 hours ago
• @LeSuisse accepted 3 days, 8 hours ago
• @LeSuisse published on GitHub 3 days, 7 hours ago

Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread …

• https://github.com/Samsung/rlottie/pull/587

---

rlottie

• ==223a2a41ba4f462e4abe767bebba49a366c9b9fd

NIXPKGS-2026-1875

GitHub issue published 3 days, 7 hours ago

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped …

Permalink CVE-2026-50292

7.4 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 days, 7 hours ago by @LeSuisse Activity log

• Created suggestion 3 days, 12 hours ago
• @LeSuisse ignored
  5 packages

  • gebaar-libinput
  • libinput-gestures
  • xf86inputlibinput
  • xf86-input-libinput
  • xlibinput-calibrator
  3 days, 8 hours ago
• @LeSuisse accepted 3 days, 8 hours ago
• @LeSuisse ignored maintainer @jtojnar 3 days, 7 hours ago maintainer.ignore
• @LeSuisse published on GitHub 3 days, 7 hours ago

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped …

• https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296 exploit
• https://gitlab.freedesktop.org/libinput/libinput/-/commit/76f0d8a7f57e286888286…
• https://www.openwall.com/lists/oss-security/2026/06/04/5

---

libinput

• <1.31.3
• <1.30.4

NIXPKGS-2026-1874

GitHub issue published 3 days, 7 hours ago

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

Permalink CVE-2026-40930

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 3 days, 7 hours ago by @LeSuisse Activity log

• Created suggestion 3 days, 12 hours ago
• @LeSuisse ignored
  3 packages

  • libpng12
  • perlPackages.ImagePNGLibpng
  • perl5Packages.ImagePNGLibpng
  3 days, 8 hours ago
• @LeSuisse accepted 3 days, 8 hours ago
• @LeSuisse published on GitHub 3 days, 7 hours ago

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

• https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x x_refsource_CONFIRM
• https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4 x_refsource_MISC
• http://www.openwall.com/lists/oss-security/2026/05/15/21

---

libpng

• === 1.8.0

libpng-apng

• ==>= 1.6.49, <= 1.6.57

NIXPKGS-2026-1873

GitHub issue published 3 days, 7 hours ago

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities

Permalink CVE-2026-8829

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 days, 7 hours ago by @LeSuisse Activity log

• Created suggestion 3 days, 12 hours ago
• @LeSuisse ignored
  2 packages

  • akkuPackages.chibi-html-parser
  • chickenPackages_5.chickenEggs.html-parser
  3 days, 8 hours ago
• @LeSuisse accepted 3 days, 8 hours ago
• @LeSuisse published on GitHub 3 days, 7 hours ago

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities

• https://github.com/libwww-perl/HTML-Parser/pull/56 patch
• https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248… patch
• http://www.openwall.com/lists/oss-security/2026/06/04/2

---

HTML-Parser

• <3.84

NIXPKGS-2026-1872

GitHub issue published 3 days, 7 hours ago

zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash

Permalink CVE-2026-10812

1.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 days, 7 hours ago by @LeSuisse Activity log

• Created suggestion 3 days, 12 hours ago
• @LeSuisse ignored
  4 references

  • https://github.com/zilliztech/GPTCache/
  • CVE-2026-10812 | CVE Analysis and Report
  • VDB-368260 | CTI Indicators (IOB, IOC, …
  • Submit #831636 | zilliztech GPTCache 0.…
  3 days, 8 hours ago
• @LeSuisse accepted 3 days, 8 hours ago
• @LeSuisse published on GitHub 3 days, 7 hours ago

zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash

• VDB-368260 | zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash vdb-entrytechnical-description
• https://github.com/zilliztech/GPTCache/issues/684 issue-trackingexploit
• https://github.com/zilliztech/GPTCache/pull/678 issue-trackingpatch

Ignored references (4)

• https://github.com/zilliztech/GPTCache/ product
• CVE-2026-10812 | CVE Analysis and Report third-party-advisory
• VDB-368260 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• Submit #831636 | zilliztech GPTCache 0.1.44 Cache poisoning / improper cache key generation third-party-advisory

---

GPTCache

• ==0.1.34
• ==0.1.33
• ==0.1.31
• ==0.1.5
• ==0.1.9
• ==0.1.6
• ==0.1.19
• ==0.1.28
• ==0.1.13
• ==0.1.25
• ==0.1.20
• ==0.1.16
• ==0.1.42
• ==0.1.2
• ==0.1.18
• ==0.1.23
• ==0.1.7
• ==0.1.11
• ==0.1.8
• ==0.1.0
• ==0.1.1
• ==0.1.38
• ==0.1.37
• ==0.1.27
• ==0.1.29
• ==0.1.4
• ==0.1.30
• ==0.1.14
• ==0.1.22
• ==0.1.36
• ==0.1.35
• ==0.1.41
• ==0.1.21
• ==0.1.17
• ==0.1.26
• ==0.1.10
• ==0.1.24
• ==0.1.12
• ==0.1.40
• ==0.1.3
• ==0.1.43
• ==0.1.44
• ==0.1.15
• ==0.1.39
• ==0.1.32