NIXPKGS-2026-2073

GitHub issue published 10 hours ago

radare2: security issues < 6.1.8

Permalink CVE-2026-14761

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  4 references

  • VDB-376350 | CTI Indicators (IOB, IOC, …
  • CVE-2026-14761 | CVE Analysis and Report
  • Submit #850385 | radareorg radare2 6.1.…
  • https://github.com/radareorg/radare2/
  10 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

radareorg radare2 str.c r_str_append integer overflow

• VDB-376350 | radareorg radare2 str.c r_str_append integer overflow vdb-entrytechnical-description
• https://github.com/radareorg/radare2/issues/26045 issue-trackingexploit
• https://github.com/radareorg/radare2/commit/a20a56917ae85d732e683f8d9078bdcfee9… patch

Ignored references (4)

• VDB-376350 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-14761 | CVE Analysis and Report third-party-advisory
• Submit #850385 | radareorg radare2 6.1.6 Integer Overflow third-party-advisory
• https://github.com/radareorg/radare2/ product

---

radare2

• ==6.1.6
• ==6.1.4
• ==6.1.2
• ==6.1.3
• ==6.1.1
• ==6.1.5
• ==6.1.0

Permalink CVE-2026-14757

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  4 references

  • https://github.com/radareorg/radare2/
  • Submit #850381 | radareorg radare2 6.1.…
  • CVE-2026-14757 | CVE Analysis and Report
  • VDB-376346 | CTI Indicators (IOB, IOC, …
  10 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow

• VDB-376346 | radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow vdb-entrytechnical-description
• https://github.com/radareorg/radare2/issues/26041 issue-trackingexploit

Ignored references (4)

• https://github.com/radareorg/radare2/ product
• Submit #850381 | radareorg radare2 6.1.6 Integer Overflow third-party-advisory
• CVE-2026-14757 | CVE Analysis and Report third-party-advisory
• VDB-376346 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required

---

radare2

• ==6.1.6
• ==6.1.4
• ==6.1.2
• ==6.1.3
• ==6.1.1
• ==6.1.5
• ==6.1.0

Permalink CVE-2026-14758

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  4 references

  • https://github.com/radareorg/radare2/
  • VDB-376347 | CTI Indicators (IOB, IOC, …
  • CVE-2026-14758 | CVE Analysis and Report
  • Submit #850382 | radareorg radare2 6.1.…
  10 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow

• VDB-376347 | radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow vdb-entrytechnical-description
• https://github.com/radareorg/radare2/issues/26042 issue-trackingexploit
• https://github.com/radareorg/radare2/commit/84e773986e7e5bb30453a9384f498ec0ccc… patch

Ignored references (4)

• https://github.com/radareorg/radare2/ product
• VDB-376347 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-14758 | CVE Analysis and Report third-party-advisory
• Submit #850382 | radareorg radare2 6.1.6 Integer Overflow third-party-advisory

---

radare2

• ==6.1.6
• ==6.1.4
• ==6.1.2
• ==6.1.3
• ==6.1.1
• ==6.1.5
• ==6.1.0

Permalink CVE-2026-14759

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  5 references

  • https://github.com/radareorg/radare2/is…
  • Submit #850383 | radareorg radare2 6.1.…
  • CVE-2026-14759 | CVE Analysis and Report
  • VDB-376348 | CTI Indicators (IOB, IOC, …
  • https://github.com/radareorg/radare2/
  10 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow

• VDB-376348 | radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow vdb-entrytechnical-description
• https://github.com/radareorg/radare2/commit/cd62d15a6cbecdc67fd03f3ebdbbbeb741d… patch

Ignored references (5)

• https://github.com/radareorg/radare2/issues/26043 issue-trackingexploit
• Submit #850383 | radareorg radare2 6.1.6 Out-of-Bounds Read third-party-advisory
• CVE-2026-14759 | CVE Analysis and Report third-party-advisory
• VDB-376348 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• https://github.com/radareorg/radare2/ product

---

radare2

• ==6.1.6
• ==6.1.4
• ==6.1.2
• ==6.1.3
• ==6.1.1
• ==6.1.5
• ==6.1.0

Permalink CVE-2026-14760

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  5 references

  • VDB-376349 | CTI Indicators (IOB, IOC, …
  • CVE-2026-14760 | CVE Analysis and Report
  • Submit #850384 | radareorg radare2 6.1.…
  • https://github.com/radareorg/radare2/is…
  • https://github.com/radareorg/radare2/
  10 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free

• VDB-376349 | radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free vdb-entrytechnical-description
• https://github.com/radareorg/radare2/commit/8b25c773785d85cb0103410a0905089d286… patch

Ignored references (5)

• VDB-376349 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-14760 | CVE Analysis and Report third-party-advisory
• Submit #850384 | radareorg radare2 6.1.6 Use After Free third-party-advisory
• https://github.com/radareorg/radare2/issues/26044 issue-trackingexploit
• https://github.com/radareorg/radare2/ product

---

radare2

• ==6.1.6
• ==6.1.4
• ==6.1.2
• ==6.1.3
• ==6.1.1
• ==6.1.5
• ==6.1.0

NIXPKGS-2026-2072

GitHub issue published 10 hours ago

Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery

Permalink CVE-2026-14570

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery

• https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.21/source/lib/Crypt/DSA/Util.…
• https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.22/diff/TIMLEGGE/Crypt-DSA-1.…
• https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.22/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/07/05/1

---

Crypt-DSA

• <1.22

NIXPKGS-2026-2071

GitHub issue published 10 hours ago

exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash

Permalink CVE-2026-14738

2.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  4 references

  • https://github.com/exo-explore/exo/
  • Submit #848737 | exo-explore exo 1.0.71…
  • CVE-2026-14738 | CVE Analysis and Report
  • VDB-376321 | CTI Indicators (IOB, IOC, …
  10 hours ago
• @LeSuisse ignored
  16 packages

  • exodus
  • exomizer
  • hexo-cli
  • xfce.exo
  • exonerate
  • libexosip
  • xfce4-exo
  • exoscale-cli
  • pkgsRocm.exo
  • flexoptix-app
  • haskellPackages.exon
  • haskellPackages.exomizer
  • terraform-providers.exoscale
  • indi-3rdparty.indi-bresserexos2
  • haskellPackages.exotic-list-monads
  • terraform-providers.exoscale_exoscale
  10 hours ago
• @LeSuisse restored package pkgsRocm.exo 10 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash

• VDB-376321 | exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash vdb-entrytechnical-description
• https://github.com/exo-explore/exo/issues/2151 issue-trackingexploit
• https://github.com/exo-explore/exo/pull/2152 patchissue-tracking

Ignored references (4)

• https://github.com/exo-explore/exo/ product
• Submit #848737 | exo-explore exo 1.0.71 Use of Weak Hash third-party-advisory
• CVE-2026-14738 | CVE Analysis and Report third-party-advisory
• VDB-376321 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required

---

exo

• ==1.0.10
• ==1.0.12
• ==1.0.17
• ==1.0.34
• ==1.0.1
• ==1.0.42
• ==1.0.54
• ==1.0.41
• ==1.0.56
• ==1.0.61
• ==1.0.64
• ==1.0.5
• ==1.0.9
• ==1.0.3
• ==1.0.2
• ==1.0.46
• ==1.0.59
• ==1.0.27
• ==1.0.26
• ==1.0.23
• ==1.0.50
• ==1.0.11
• ==1.0.57
• ==1.0.67
• ==1.0.49
• ==1.0.63
• ==1.0.51
• ==1.0.20
• ==1.0.35
• ==1.0.24
• ==1.0.69
• ==1.0.8
• ==1.0.4
• ==1.0.58
• ==1.0.21
• ==1.0.62
• ==1.0.28
• ==1.0.30
• ==1.0.25
• ==1.0.37
• ==1.0.44
• ==1.0.32
• ==1.0.47
• ==1.0.31
• ==1.0.68
• ==1.0.13
• ==1.0.15
• ==1.0.36
• ==1.0.33
• ==1.0.53
• ==1.0.18
• ==1.0.52
• ==1.0.48
• ==1.0.14
• ==1.0.6
• ==1.0.40
• ==1.0.70
• ==1.0.16
• ==1.0.45
• ==1.0.66
• ==1.0.39
• ==1.0.43
• ==1.0.29
• ==1.0.0
• ==1.0.55
• ==1.0.60
• ==1.0.71
• ==1.0.19
• ==1.0.7
• ==1.0.22
• ==1.0.38
• ==1.0.65

NIXPKGS-2026-2070

GitHub issue published 1 day, 1 hour ago

Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service

Permalink CVE-2026-14618

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored package open5gs-webui 1 day, 1 hour ago
• @LeSuisse ignored
  4 references

  • https://github.com/open5gs/open5gs/
  • Submit #844824 | Open5GS 2.7.7 Denial o…
  • CVE-2026-14618 | CVE Analysis and Report
  • VDB-376135 | CTI Indicators (IOB, IOC, …
  1 day, 1 hour ago
• @LeSuisse accepted 1 day, 1 hour ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service

• VDB-376135 | Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service vdb-entrytechnical-description
• https://github.com/open5gs/open5gs/issues/4517 issue-trackingexploit
• https://github.com/open5gs/open5gs/issues/4517#issuecomment-4589606265 issue-tracking
• https://github.com/ferrancanellas/open5gs/commit/fb5f67703de0213fb9c6e6ef3b48b6… patch

Ignored references (4)

• https://github.com/open5gs/open5gs/ product
• Submit #844824 | Open5GS 2.7.7 Denial of Service third-party-advisory
• CVE-2026-14618 | CVE Analysis and Report third-party-advisory
• VDB-376135 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required

---

Open5GS

• ==2.7.0
• ==2.7.3
• ==2.7.2
• ==2.7.4
• ==2.7.5
• ==2.7.1
• ==2.7.6
• ==2.7.7

NIXPKGS-2026-2069

GitHub issue published 1 day, 1 hour ago

Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()

Permalink CVE-2026-14535

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse accepted 1 day, 1 hour ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()

• GitHub Security Advisory GHSA-cffv-grgg-g429
• Fix PR #278 — Split shorten_code() formatting from dedup tracking, make MLAllowlist opt-in
• Fix commit 41ce7cb (squash merge of PR #278)
• Fickling v0.1.12 release

---

fickling

• =<0.1.11
• ==0.1.12

NIXPKGS-2026-2068

GitHub issue published 1 day, 1 hour ago

myVesta is affected by an authenticated remote code execution vulnerability. …

Permalink CVE-2026-12195

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 1 hour ago by @LeSuisse Activity log

• Created suggestion 1 day, 14 hours ago
• @LeSuisse ignored package vesta-viewer 1 day, 1 hour ago
• @LeSuisse accepted 1 day, 1 hour ago
• @LeSuisse published on GitHub 1 day, 1 hour ago

myVesta is affected by an authenticated remote code execution vulnerability. …

• https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422 patch
• https://projectblack.io/blog/local-ai-for-cyber-security/#myvesta-authenticated… exploit

---

vesta

• <95d7e43bf286d6881ca753dac93cb42d98cc7422

NIXPKGS-2026-2067

GitHub issue published 2 days, 8 hours ago

Hplip: incomplete fix for cve-2026-8631

Permalink CVE-2026-14544

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse ignored package gnomeExtensions.alternate-menu-for-hplip2 2 days, 8 hours ago
• @LeSuisse accepted 2 days, 8 hours ago
• @LeSuisse published on GitHub 2 days, 8 hours ago

Hplip: incomplete fix for cve-2026-8631

• https://access.redhat.com/security/cve/CVE-2026-14544 vdb-entryx_refsource_REDHAT
• RHBZ#2496772 issue-trackingx_refsource_REDHAT

---

hplip

NIXPKGS-2026-2066

GitHub issue published 2 days, 8 hours ago

Gimp: gimp: heap buffer overflow in read_channel_data()

Permalink CVE-2026-58379

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse ignored
  19 packages

  • gimp2
  • gimp-with-plugins
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.lightning
  • gimp2Plugins.texturize
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  • gimp2Plugins.farbfeld
  • gimp3-with-plugins
  • gimpPlugins.lightning
  • gimp2Plugins.fourier
  • gimpPlugins.gmic
  • gimpPlugins.gimp
  • zigimports
  2 days, 8 hours ago
• @LeSuisse accepted 2 days, 8 hours ago
• @LeSuisse published on GitHub 2 days, 8 hours ago

Gimp: gimp: heap buffer overflow in read_channel_data()

• https://access.redhat.com/security/cve/CVE-2026-58379 vdb-entryx_refsource_REDHAT
• RHBZ#2495997 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167
• https://gitlab.gnome.org/GNOME/gimp/-/issues/16205

---

gimp

gimp:2.8/gimp

NIXPKGS-2026-2065

GitHub issue published 2 days, 8 hours ago

assimp: security issues < 6.0.4

Permalink CVE-2026-14610

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 2 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse ignored
  3 references

  • VDB-376118 | CTI Indicators (IOB, IOC, …
  • CVE-2026-14610 | CVE Analysis and Report
  • Submit #844646 | Assimp commit 17c12da …
  2 days, 8 hours ago
• @LeSuisse accepted 2 days, 8 hours ago
• @LeSuisse published on GitHub 2 days, 8 hours ago

Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow

• VDB-376118 | Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow vdb-entrytechnical-description
• https://github.com/assimp/assimp/issues/6622 issue-tracking
• https://github.com/assimp/assimp/pull/6649 patchissue-tracking
• https://github.com/user-attachments/files/27235863/poc.zip exploit
• https://github.com/assimp/assimp/commit/eb84eec580d3f4ba2f0fd87409b7d0744620f11e patch

Ignored references (3)

• VDB-376118 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-14610 | CVE Analysis and Report third-party-advisory
• Submit #844646 | Assimp commit 17c12da Heap-based Buffer Overflow third-party-advisory

---

Assimp

• ==6.0.4
• ==6.0.1
• ==6.0.2
• ==6.0.0
• ==6.0.3
• ==6.0.5

Permalink CVE-2026-14604

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 2 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 2 days, 14 hours ago
• @LeSuisse ignored
  3 references

  • VDB-376112 | CTI Indicators (IOB, IOC, …
  • CVE-2026-14604 | CVE Analysis and Report
  • Submit #844567 | Assimp commit 17c12da …
  2 days, 8 hours ago
• @LeSuisse accepted 2 days, 8 hours ago
• @LeSuisse published on GitHub 2 days, 8 hours ago

Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free

• VDB-376112 | Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free vdb-entrytechnical-description
• https://github.com/assimp/assimp/issues/6620 issue-tracking
• https://github.com/user-attachments/files/27232640/poc.zip exploit

Ignored references (3)

• VDB-376112 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-14604 | CVE Analysis and Report third-party-advisory
• Submit #844567 | Assimp commit 17c12da Double Free third-party-advisory

---

Assimp

• ==6.0.4
• ==6.0.1
• ==6.0.2
• ==6.0.0
• ==6.0.3

NIXPKGS-2026-2064

GitHub issue published 2 days, 21 hours ago

Gimp: gimp: double-free in read_layer_block()

Permalink CVE-2026-58381

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 2 days, 21 hours ago by @LeSuisse Activity log

• Created suggestion 3 days, 14 hours ago
• @LeSuisse ignored
  19 packages

  • gimp2
  • zigimports
  • gimpPlugins.gimp
  • gimpPlugins.gmic
  • gimp-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp3-with-plugins
  • gimp2Plugins.fourier
  • gimp2Plugins.farbfeld
  • gimpPlugins.lightning
  • gimp2Plugins.lightning
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.texturize
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  2 days, 21 hours ago
• @LeSuisse accepted 2 days, 21 hours ago
• @LeSuisse published on GitHub 2 days, 21 hours ago

Gimp: gimp: double-free in read_layer_block()

• https://access.redhat.com/security/cve/CVE-2026-58381 x_refsource_REDHATvdb-entry
• RHBZ#2496166 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/gimp/-/commit/b22e147b
• https://gitlab.gnome.org/GNOME/gimp/-/issues/16207

---

gimp

gimp:2.8/gimp

Needs some backports or patches for stable