Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-2473
published 1 week, 3 days ago
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Permalink CVE-2026-84305
5.1 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

sqlparse
  • ==< 0.6.0
NIXPKGS-2026-2472
published 1 week, 3 days ago
gvfs: security issues < 1.61.90
Permalink CVE-2026-84269
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse ignored package yaziPlugins.gvfs 1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

Gvfs: afp: heap-based buffer overflow in dsi read path

gvfs
Fixed in 1.61.90

https://gitlab.gnome.org/GNOME/gvfs/-/commit/072a7e02d11f5b7dfa324b70dd0e16d60f9b9e60
Permalink CVE-2026-84268
8.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse ignored package yaziPlugins.gvfs 1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

Gvfs: sftp: heap-based buffer overflow in read_reply()

gvfs
Fixed in 1.61.90

https://gitlab.gnome.org/GNOME/gvfs/-/commit/5ab77256f9c071c7c99a5298db1729cf143bff05
Permalink CVE-2026-84267
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse ignored package yaziPlugins.gvfs 1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

Gvfs: sftp: uninitialized heap disclosure in read_string()

gvfs
Fixed in 1.61.90

https://gitlab.gnome.org/GNOME/gvfs/-/commit/d9a59b8e385189b4783d9b66ca475f530fb26693
Permalink CVE-2026-84270
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Physical (P)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Physical (P)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse ignored package yaziPlugins.gvfs 1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

Gvfs: mtp: out-of-bounds read in do_read()

gvfs
Fixed in 1.61.90

https://gitlab.gnome.org/GNOME/gvfs/-/commit/070e5e4223c97f7e793a342ba6e64df1095ccb0d
NIXPKGS-2026-2471
published 1 week, 3 days ago
librenms: security issues < 26.7.0 (backport needed)
Permalink CVE-2026-84189
9.2 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): High (H)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): High (H)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

LibreNMS before 26.7.0 Stored XSS via Oxidized API

librenms
  • <26.7.0
  • ==26.7.0 
Needs some backport to stable
Permalink CVE-2026-84188
4.8 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): Low (L)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Low (L)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

librenms before 26.7.0 Stored XSS via graph_descr settings

librenms
  • <26.7.0
  • ==26.7.0 
Needs some backport to stable
NIXPKGS-2026-2470
published 1 week, 3 days ago
svgo: security issues < 4.1.0
Permalink CVE-2026-84369
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse ignored package haskellPackages.svgone 1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

svgo
  • ==>= 3.0.0, < 3.3.5
  • ==>= 1.0.0, < 2.8.4
  • ==>= 4.0.0, < 4.1.0
Permalink CVE-2026-84370
8.2 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse ignored package haskellPackages.svgone 1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

SVGO: removeScripts allows executable links through namespace and control-character bypasses

svgo
  • ==>= 3.0.0, < 3.3.5
  • ==>= 1.0.0, < 2.8.4
  • ==>= 4.0.0, < 4.1.0
Permalink CVE-2026-73650
8.2 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 4 weeks, 1 day ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse ignored package haskellPackages.svgone 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

SVGO: removeScripts plugin leaves some executable scripts intact

svgo
  • ==>= 3.0.0, < 3.3.4
  • ==>= 1.0.0, < 2.8.3
  • ==>= 4.0.0, < 4.0.2
NIXPKGS-2026-2469
published 1 week, 3 days ago
Composer: Perforce source URL permits P4PORT `rsh:` command execution
Permalink CVE-2026-84361
7.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse ignored
    13 packages
    • subtitlecomposer
    • composer-require-checker
    • haskellPackages.gogol-composer
    • phpPackages.cyclonedx-php-composer
    • php82Packages.cyclonedx-php-composer
    • php83Packages.cyclonedx-php-composer
    • php84Packages.cyclonedx-php-composer
    • php85Packages.cyclonedx-php-composer
    • phpPackages.composer-local-repo-plugin
    • php82Packages.composer-local-repo-plugin
    • php83Packages.composer-local-repo-plugin
    • php84Packages.composer-local-repo-plugin
    • php85Packages.composer-local-repo-plugin
    1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

Composer: Perforce source URL permits P4PORT `rsh:` command execution

composer
  • ==>= 1.0, < 2.2.30
  • ==>= 2.3.0, < 2.10.3
NIXPKGS-2026-2468
published 1 week, 3 days ago
python3Packages.pypdf: security issues < 6.16.1
Permalink CVE-2026-84311
4.8 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse ignored
    7 packages
    • capypdf
    • python313Packages.pypdf2
    • python313Packages.pypdf3
    • python314Packages.pypdf2
    • python314Packages.pypdf3
    • python314Packages.pypdfium2
    • python313Packages.pypdfium2
    1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

pypdf
  • ==< 6.16.1
Permalink CVE-2026-84310
4.8 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse ignored
    7 packages
    • capypdf
    • python313Packages.pypdf2
    • python313Packages.pypdf3
    • python314Packages.pypdf2
    • python314Packages.pypdf3
    • python313Packages.pypdfium2
    • python314Packages.pypdfium2
    1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

pypdf: Possible long runtimes/large memory usage when retrieving outlines

pypdf
  • ==< 6.16.1
Permalink CVE-2026-84309
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 week, 3 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 3 days ago
  • @LeSuisse ignored
    7 packages
    • capypdf
    • python313Packages.pypdf2
    • python313Packages.pypdf3
    • python314Packages.pypdf2
    • python314Packages.pypdf3
    • python313Packages.pypdfium2
    • python314Packages.pypdfium2
    1 week, 3 days ago
  • @LeSuisse accepted 1 week, 3 days ago
  • @LeSuisse published on GitHub 1 week, 3 days ago

pypdf: Possible infinite loop for TreeObject.insert_child

pypdf
  • ==< 6.16.0
NIXPKGS-2026-2467
published 1 week, 4 days ago
Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized …
Permalink CVE-2026-82797
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 1 week, 4 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 4 days ago
  • @LeSuisse ignored package libsForQt5.rlottie-qml 1 week, 4 days ago
  • @LeSuisse accepted 1 week, 4 days ago
  • @LeSuisse published on GitHub 1 week, 4 days ago

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized …

rlottie
  • <8de0d9e6ca80ffef654965505981727b9fa06a51
NIXPKGS-2026-2466
published 1 week, 4 days ago
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Permalink CVE-2026-82397
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 1 week, 4 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 4 days ago
  • @LeSuisse ignored
    4 packages
    • python313Packages.pytest-tornado
    • python313Packages.sockjs-tornado
    • python314Packages.pytest-tornado
    • python314Packages.sockjs-tornado
    1 week, 4 days ago
  • @LeSuisse accepted 1 week, 4 days ago
  • @LeSuisse published on GitHub 1 week, 4 days ago

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

tornado
  • ==< 6.5.8
NIXPKGS-2026-2465
published 1 week, 4 days ago
open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free
Permalink CVE-2026-82623
5.5 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
updated 1 week, 4 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 4 days ago
  • @LeSuisse ignored package open62541pp 1 week, 4 days ago
  • @LeSuisse ignored reference https://g… 1 week, 4 days ago
  • @LeSuisse accepted 1 week, 4 days ago
  • @LeSuisse published on GitHub 1 week, 4 days ago

open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free

open62541
  • ==1.5.0
  • ==1.5.4
  • ==1.5.3
  • ==1.5.1
  • ==1.5.2
  • ==1.5.5
NIXPKGS-2026-2464
published 1 week, 4 days ago
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Permalink CVE-2026-62993
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 week, 4 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 4 days ago
  • @LeSuisse ignored
    6 packages
    • smarty3-i18n
    • haskellPackages.HSmarty
    • python313Packages.pysmarty2
    • python314Packages.pysmarty2
    • python313Packages.smartypants
    • python314Packages.smartypants
    1 week, 4 days ago
  • @LeSuisse accepted 1 week, 4 days ago
  • @LeSuisse published on GitHub 1 week, 4 days ago

Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

smarty
  • ==>= 5.0.0, < 5.8.2
  • ==< 4.5.7