NIXPKGS-2026-2172

GitHub issue published 3 hours ago

OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection

Permalink CVE-2026-5663

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Exploit Code Maturity (E): Not Defined (X)
• Remediation Level (RL): Official Fix (O)
• Report Confidence (RC): Confirmed (C)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse ignored
  2 references

  • Submit #786061 | OFFIS DCMTK up to 3.7.…
  • VDB-355486 | CTI Indicators (IOB, IOC, …
  19 hours ago
• @LeSuisse accepted 19 hours ago
• @LeSuisse ignored maintainer @iimog 3 hours ago maintainer.ignore
• @LeSuisse published on GitHub 3 hours ago

OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection

• VDB-355486 | OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection technical-descriptionvdb-entry
• Submit #786061 | OFFIS DCMTK up to 3.7.0 OS Command Injection third-party-advisory
• https://machinespirits.com/advisory/2e1627/ related
• https://support.dcmtk.org/redmine/issues/1194 issue-tracking
• https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8 patch

Ignored references (1)

• VDB-355486 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature

---

DCMTK

• ==3.7.0
• ==3.1
• ==3.2
• ==3.3
• ==3.5
• ==3.6
• ==3.4
• ==3.0

NIXPKGS-2026-2171

GitHub issue published 3 hours ago

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected

Permalink CVE-2026-5090

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected

• https://github.com/abw/Template2/issues/327 issue-tracking
• https://github.com/abw/Template2/pull/337/changes/11c78a7a771d4af505efeb754a0b8… patch
• http://www.openwall.com/lists/oss-security/2026/05/19/40

---

Template-Toolkit

• =<3.102

NIXPKGS-2026-2170

GitHub issue published 5 days, 5 hours ago

Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size

Permalink CVE-2026-15551

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 5 days, 5 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 12 hours ago
• @LeSuisse ignored package libsForQt5.rlottie-qml 5 days, 5 hours ago
• @LeSuisse accepted 5 days, 5 hours ago
• @LeSuisse published on GitHub 5 days, 5 hours ago

Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size

• https://github.com/Samsung/rlottie/pull/595

---

rlottie

• ==bf689b72b8482c5ea674235854bd11b6d1b42588

Patch: https://github.com/Samsung/rlottie/commit/f487eff2f8086b84ae1c7faa0418abec909e874b

NIXPKGS-2026-2169

GitHub issue published 5 days, 5 hours ago

Blender 3.0.0 - 5.1.2 Out-of-Bounds Read via crafted .blend SDNA block

Permalink CVE-2026-60103

6.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 5 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 12 hours ago
• @LeSuisse accepted 5 days, 5 hours ago
• @LeSuisse published on GitHub 5 days, 5 hours ago

Blender 3.0.0 - 5.1.2 Out-of-Bounds Read via crafted .blend SDNA block

• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/blender-out-of-bounds-read-via-crafted-ble… third-party-advisory

---

blender

• ==968972a918b5ed2d534295b639c54449d7de11cd
• =<5.1.2

NIXPKGS-2026-2168

GitHub issue published 5 days, 5 hours ago

AnyDesk Support Information Link Following Denial-of-Service Vulnerability

Permalink CVE-2026-15682

4.7 MEDIUM

• CVSS version (CVSS): 3.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 days, 5 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 12 hours ago
• @LeSuisse accepted 5 days, 5 hours ago
• @LeSuisse published on GitHub 5 days, 5 hours ago

AnyDesk Support Information Link Following Denial-of-Service Vulnerability

• ZDI-26-401 x_research-advisory

---

AnyDesk

• ==9.0.4

NIXPKGS-2026-2167

GitHub issue published 5 days, 5 hours ago

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability

Permalink CVE-2026-15681

4.7 MEDIUM

• CVSS version (CVSS): 3.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 days, 5 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 12 hours ago
• @LeSuisse accepted 5 days, 5 hours ago
• @LeSuisse published on GitHub 5 days, 5 hours ago

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability

• ZDI-26-400 x_research-advisory

---

AnyDesk

• ==9.0.4

NIXPKGS-2026-2166

GitHub issue published 5 days, 5 hours ago

GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow

Permalink CVE-2026-15520

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 5 days, 5 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 12 hours ago
• @LeSuisse ignored
  4 references

  • https://www.gnu.org/
  • Submit #851190 | LibreDWG 0.13.4-154-g0…
  • CVE-2026-15520 | CVE Analysis and Report
  • VDB-377849 | CTI Indicators (IOB, IOC, …
  5 days, 5 hours ago
• @LeSuisse accepted 5 days, 5 hours ago
• @LeSuisse published on GitHub 5 days, 5 hours ago

GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow

• VDB-377849 | GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow technical-descriptionvdb-entry
• https://github.com/LibreDWG/libredwg/issues/1251 issue-trackingexploit
• https://github.com/advisories/GHSA-qg2f-8389-w95j issue-trackingbroken-link
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_0b57303_heap… exploit
• https://github.com/LibreDWG/libredwg/commit/3d0f9fc2eddbd6579c99af3111c37c98f03… patch
• https://github.com/LibreDWG/libredwg/releases/tag/0.14.8396 patch

Ignored references (4)

• https://www.gnu.org/ productbroken-link
• Submit #851190 | LibreDWG 0.13.4-154-g0b573035 (main branch, commit 0b573035, 2026-04-29) 内存损坏 (Heap Buffer Overflow - Write) third-party-advisory
• CVE-2026-15520 | CVE Analysis and Report third-party-advisory
• VDB-377849 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required

---

LibreDWG

• ==0.13.4-154-g0b573035
• ==0.14.8396

NIXPKGS-2026-2165

GitHub issue published 5 days, 5 hours ago

filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete

Permalink CVE-2026-61874

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 5 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 12 hours ago
• @LeSuisse ignored
  3 packages

  • filebrowser-quantum
  • python313Packages.filebrowser-safe
  • python314Packages.filebrowser-safe
  5 days, 5 hours ago
• @LeSuisse accepted 5 days, 5 hours ago
• @LeSuisse published on GitHub 5 days, 5 hours ago

filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete

• GitHub Security Advisory (GHSA-pp88-jhwj-5qh5) vendor-advisory
• https://github.com/filebrowser/filebrowser/commit/be23ab3a15bf957928ecfed88de5ab67850c1b9c patch
• VulnCheck Advisory: filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete third-party-advisory

---

filebrowser

• <2.63.17
• ==2.63.17

NIXPKGS-2026-2164

GitHub issue published 5 days, 5 hours ago

Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__

Permalink CVE-2026-61454

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 5 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 12 hours ago
• @LeSuisse ignored
  16 packages

  • gravit
  • antigravity
  • antigravity-cli
  • antigravity-fhs
  • stardust-xr-gravity
  • kdePackages.libgravatar
  • gnomeExtensions.gravatar
  • haskellPackages.gravatar
  • python313Packages.libgravatar
  • python314Packages.libgravatar
  • python313Packages.flask-gravatar
  • python314Packages.flask-gravatar
  • python313Packages.django-gravatar2
  • python314Packages.django-gravatar2
  • perlPackages.MojoliciousPluginGravatar
  • perl5Packages.MojoliciousPluginGravatar
  5 days, 5 hours ago
• @LeSuisse accepted 5 days, 5 hours ago
• @LeSuisse published on GitHub 5 days, 5 hours ago

Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__

• GitHub Security Advisory (GHSA-pfjq-chp8-3vgh) vendor-advisory
• VulnCheck Advisory: Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__ third-party-advisory

---

grav

• ==2.0.4
• <2.0.4

NIXPKGS-2026-2163

GitHub issue published 5 days, 5 hours ago

Out-of-bound read in mtr

Permalink CVE-2026-14461

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 5 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 12 hours ago
• @LeSuisse ignored
  22 packages

  • mtrace
  • gomtree
  • memtree
  • mtr-gui
  • nmtrust
  • rmtrash
  • vgmtrans
  • hamtransfer
  • mtr-exporter
  • schismtracker
  • nltk-data.comtrans
  • typstPackages.mtret
  • dockapps.wmsystemtray
  • ocamlPackages.memtrace
  • haskellPackages.paramtree
  • haskellPackages.simtreelo
  • typstPackages.mtret_0_1_0
  • python313Packages.pykmtronic
  • python314Packages.pykmtronic
  • ocamlPackages_latest.memtrace
  • python313Packages.iterative-telemetry
  • python314Packages.iterative-telemetry
  5 days, 5 hours ago
• @LeSuisse accepted 5 days, 5 hours ago
• @LeSuisse published on GitHub 5 days, 5 hours ago

Out-of-bound read in mtr

• https://cert.pl/en/posts/2026/07/CVE-2026-14461 third-party-advisory
• https://github.com/traviscross/mtr/commit/48e1794414d338ce47abc0f27c25ade8788af… patch

---

mtr

• =<0.96