NIXPKGS-2026-0996

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-24660

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored package libraw1394 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality …

• https://talosintelligence.com/vulnerability_reports/TALOS-2026-2359
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2359

---

LibRaw

• ==Commit d20315b

Upstream patch: https://github.com/LibRaw/LibRaw/commit/a4a0ab69d286c7638741e70a11f04fb3d7b49db2

NIXPKGS-2026-0995

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-31842

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling

• Upstream issue report and reproduction details issue-trackingtechnical-descriptionthird-party-advisory

Ignored references (2)

• Tinyproxy upstream project product
• RFC 7230: transfer-coding names are case-insensitive technical-description

---

Tinyproxy

• =<1.11.3

NIXPKGS-2026-0994

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35491

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  5 packages

  • swiftlint
  • python312Packages.softlayer
  • python313Packages.softlayer
  • python314Packages.softlayer
  • chickenPackages_5.chickenEggs.ftl
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration

• https://github.com/pi-hole/FTL/security/advisories/GHSA-r7g8-3fj7-m5qq x_refsource_CONFIRM

---

FTL

• ==>= 6.0, < 6.6

NIXPKGS-2026-0993

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-39361

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url

• https://github.com/openobserve/openobserve/security/advisories/GHSA-gcwf-3p7h-wm79 x_refsource_CONFIRM
• https://github.com/openobserve/openobserve/commit/d1a5d8f65b432e2e82f83231390dec7f107e8d75 x_refsource_MISC

---

openobserve

• ==<= 0.70.3

NIXPKGS-2026-0992

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35518

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  5 packages

  • swiftlint
  • python312Packages.softlayer
  • python313Packages.softlayer
  • python314Packages.softlayer
  • chickenPackages_5.chickenEggs.ftl
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection

• https://github.com/pi-hole/FTL/security/advisories/GHSA-28g5-gg88-wh5m x_refsource_CONFIRM

---

FTL

• ==>= 6.0, < 6.6

NIXPKGS-2026-0991

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-34080

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception

• https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-vjp5-hjfm-7677 x_refsource_CONFIRM

---

xdg-dbus-proxy

• ==< 0.1.7

NIXPKGS-2026-0990

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-5747

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Out-of-bounds Write in Firecracker virtio-pci Transport

• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.15.1 patch
• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.4 patch
• https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-776… third-party-advisory

Ignored references (1)

• https://aws.amazon.com/security/security-bulletins/2026-015-aws/ vendor-advisory

---

Firecracker

• ==1.15.1
• ==1.14.4
• ==1.15.0
• =<1.14.3

NIXPKGS-2026-0989

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35611

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Addressable has a Regular Expression Denial of Service in Addressable templates

• https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4 x_refsource_CONFIRM

---

addressable

• ==>= 2.3.0, < 2.9.0

NIXPKGS-2026-0988

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-39365

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  7 packages

  • vite
  • vitess
  • vitetris
  • python312Packages.django-vite
  • python313Packages.django-vite
  • python314Packages.django-vite
  • vscode-extensions.vitest.explorer
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Vite has a Path Traversal in Optimized Deps `.map` Handling

• https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9 x_refsource_CONFIRM

---

vite

• ==>= 6.0.0, < 6.4.2
• ==>= 8.0.0, < 8.0.5
• ==>= 7.0.0, < 7.3.2

vite-plus

• ==< 0.1.16

NIXPKGS-2026-0987

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35464

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  5 packages

  • python312Packages.pyloadapi
  • python313Packages.pyloadapi
  • python314Packages.pyloadapi
  • home-assistant-component-tests.pyload
  • tests.home-assistant-component-tests.pyload
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution

• https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j x_refsource_CONFIRMexploit
• https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxx x_refsource_MISC
• https://github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1 x_refsource_MISC

Ignored references (1)

• https://www.cve.org/CVERecord?id=CVE-2026-33509 x_refsource_MISC

---

pyload

• ==<= 0.5.0b3.dev96