NIXPKGS-2026-1909

GitHub issue published 12 hours ago

draw.io: XSS via crafted cell label when opening a .drawio file

Permalink CVE-2026-46642

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  6 packages

  • pandoc-drawio-filter
  • python313Packages.mkdocs-drawio-file
  • python314Packages.mkdocs-drawio-file
  • vscode-extensions.hediet.vscode-drawio
  • python313Packages.mkdocs-drawio-exporter
  • python314Packages.mkdocs-drawio-exporter
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 12 hours ago

draw.io: XSS via crafted cell label when opening a .drawio file

• https://github.com/jgraph/drawio/security/advisories/GHSA-fqhg-287p-c6vf x_refsource_CONFIRM
• https://github.com/jgraph/drawio/releases/tag/v29.7.12 x_refsource_MISC

---

drawio

• ==< 29.7.12

NIXPKGS-2026-1908

GitHub issue published 12 hours ago

OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning

Permalink CVE-2026-48096

5.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  3 packages

  • openfga-cli
  • python313Packages.openfga-sdk
  • python314Packages.openfga-sdk
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 12 hours ago

OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning

• https://github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4w x_refsource_CONFIRM
• https://github.com/openfga/openfga/releases/tag/v1.16.0 x_refsource_MISC

---

openfga

• ==< 1.16.0

NIXPKGS-2026-1907

GitHub issue published 12 hours ago

libnfs through 6.0.2 before 55c18ea does not validate a string …

Permalink CVE-2026-53689

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 12 hours ago

libnfs through 6.0.2 before 55c18ea does not validate a string …

• https://github.com/sahlberg/libnfs/commit/55c18ea33a83d667f79f0ef209c96895795c7…

---

libnfs

• <55c18ea33a83d667f79f0ef209c96895795c729f

NIXPKGS-2026-1906

GitHub issue published 12 hours ago

Insufficient verification that responses belong to a query

Permalink CVE-2026-10846

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  4 packages

  • perlPackages.ZonemasterLDNS
  • perl5Packages.ZonemasterLDNS
  • terraform-providers.vinyldns
  • terraform-providers.vinyldns_vinyldns
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 12 hours ago

Insufficient verification that responses belong to a query

• https://www.nlnetlabs.nl/downloads/ldns/CVE-2026-10846.txt vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/06/10/2

---

ldns

• <1.9.1

NIXPKGS-2026-1905

GitHub issue published 12 hours ago

Dracut: dracut: root code execution via dhcp options command injection

Permalink CVE-2026-6893

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

Dracut: dracut: root code execution via dhcp options command injection

• https://access.redhat.com/security/cve/CVE-2026-6893 vdb-entryx_refsource_REDHAT
• RHBZ#2459963 issue-trackingx_refsource_REDHAT

---

rhcos

dracut

Needs further analysis.

NIXPKGS-2026-1904

GitHub issue published 12 hours ago

Stack memory disclosure in filemd5 command

Permalink CVE-2026-9754

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 12 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 18 hours ago
• @LeSuisse ignored
  22 packages

  • mongodb-cli
  • mongodb-compass
  • mongodb-atlas-cli
  • phpExtensions.mongodb
  • haskellPackages.mongoDB
  • php82Extensions.mongodb
  • php83Extensions.mongodb
  • php84Extensions.mongodb
  • php85Extensions.mongodb
  • akkuPackages.r6rs-mongodb
  • prometheus-mongodb-exporter
  • haskellPackages.pipes-mongodb
  • graylogPlugins.mongodb-profiler
  • terraform-providers.mongodbatlas
  • python313Packages.langchain-mongodb
  • python314Packages.langchain-mongodb
  • terraform-providers.mongodb_mongodbatlas
  • vscode-extensions.mongodb.mongodb-vscode
  • python313Packages.langgraph-store-mongodb
  • python314Packages.langgraph-store-mongodb
  • python313Packages.langgraph-checkpoint-mongodb
  • python314Packages.langgraph-checkpoint-mongodb
  12 hours ago
• @LeSuisse accepted 12 hours ago
• @LeSuisse published on GitHub 12 hours ago

Stack memory disclosure in filemd5 command

• https://jira.mongodb.org/browse/SERVER-122207

---

MongoDB

• <8.3.3
• <8.2.10

NIXPKGS-2026-1903

GitHub issue published 13 hours ago

python3Packages.kafka-python-ng: DoS issues < 2.3.2

Permalink CVE-2026-10142

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame Length

• https://www.vulncheck.com/advisories/kafka-python-prior-to-denial-of-service-vi… third-party-advisorytechnical-description
• https://github.com/dpkp/kafka-python/pull/3019
• https://github.com/dpkp/kafka-python/pull/3026
• https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea… patch

---

kafka-python

• <2.3.2

Permalink CVE-2026-10143

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py

• https://github.com/dpkp/kafka-python/pull/3019 technical-description
• https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea… patch
• https://github.com/dpkp/kafka-python/pull/3026
• https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iterat… third-party-advisory

---

kafka-python

• <2.3.2

NIXPKGS-2026-1902

GitHub issue published 13 hours ago

Weblate: security issues < 2026.6

Permalink CVE-2026-50127

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  6 packages

  • python313Packages.weblate-fonts
  • python314Packages.weblate-fonts
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vmfc-9982-2m45 x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/pull/19768 x_refsource_MISC
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.6 x_refsource_MISC

---

weblate

• ==>= 5.15, < 2026.6

Permalink CVE-2026-45106

4.6 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  6 packages

  • python313Packages.weblate-fonts
  • python314Packages.weblate-fonts
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

Weblate: Stored HTML injection in editor search preview

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26m x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/pull/19422 x_refsource_MISC
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5 x_refsource_MISC

---

weblate

• ==< 2026.5

NIXPKGS-2026-1901

GitHub issue published 13 hours ago

Jenkins: security issues < 2.555.3

Permalink CVE-2026-53436

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53440

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53437

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53435

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53442

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53441

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• <2.483
• *
• <2.555.*

Permalink CVE-2026-53438

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

A missing permission check in Jenkins 2.567 and earlier, LTS …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53439

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  13 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

NIXPKGS-2026-1900

GitHub issue published 13 hours ago

ImageMagick: security issues < 7.1.2-25

Permalink CVE-2026-53464

4.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  2 packages

  • haskellPackages.ihp-imagemagick
  • graphicsmagick-imagemagick-compat
  14 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

ImageMagick: Memory Leak in wand option parser when providing invalid arguments

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j989-f892-2335 x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-25

Permalink CVE-2026-53463

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  14 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

ImageMagick: Null Pointer Dereference in distort operation when passing incorrect arguments

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p9rq-q46c-g4x6 x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-25
• ==< 6.9.13-50

Permalink CVE-2026-53461

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  14 hours ago
• @LeSuisse accepted 13 hours ago
• @LeSuisse published on GitHub 13 hours ago

ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-25
• ==< 6.9.13-50

Permalink CVE-2026-53465

6.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  14 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 13 hours ago

ImageMagick: Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-44cp-c3ww-9rv5 x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-25

Permalink CVE-2026-53462

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  14 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 13 hours ago

ImageMagick: Use-After-Free when allocation in CheckPrimitiveExtent fails

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-px7q-ggqj-hcf2 x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-25
• ==< 6.9.13-50

Permalink CVE-2026-53460

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 13 hours ago by @LeSuisse Activity log

• Created suggestion 19 hours ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  14 hours ago
• @LeSuisse accepted 14 hours ago
• @LeSuisse published on GitHub 13 hours ago

ImageMagick: Policy Bypass can trigger out-of-Memory condition

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-25
• ==< 6.9.13-50