NIXPKGS-2026-1594

GitHub issue published 4 months ago

Permalink CVE-2026-44432

8.9 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  12 packages

  • kodiPackages.urllib3
  • python312Packages.types-urllib3
  • python313Packages.types-urllib3
  • python314Packages.types-urllib3
  • python312Packages.urllib3-future
  • python313Packages.urllib3-future
  • python314Packages.urllib3-future
  • python313Packages.lance-namespace-urllib3-client
  • python314Packages.lance-namespace-urllib3-client
  • python312Packages.opentelemetry-instrumentation-urllib3
  • python313Packages.opentelemetry-instrumentation-urllib3
  • python314Packages.opentelemetry-instrumentation-urllib3
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

• https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j x_refsource_CONFIRM

---

urllib3

• ==>= 2.6.0, < 2.7.0

NIXPKGS-2026-1593

GitHub issue published 4 months ago

Permalink CVE-2026-8463

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input

• https://github.com/Leont/crypt-argon2/commit/92eac03ce63d541e0ead7ea5a89b9b67ce… patch
• https://metacpan.org/release/LEONT/Crypt-Argon2-0.031/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/05/13/4

---

Crypt-Argon2

• <0.031

NIXPKGS-2026-1592

GitHub issue published 4 months ago

Permalink CVE-2026-8496

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

A cross-site scripting (XSS) vulnerability in Alinto SOGo, version 5.12.7

• https://github.com/Alinto/sogo/commit/67ce01ec2a1a7854d8e9f615dd65afb949043e86
• https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8
• https://www.sogo.nu/news/2026/sogo-v5128-released.html

---

SOGo

• <5.12.8

NIXPKGS-2026-1591

GitHub issue published 4 months ago

Permalink CVE-2026-42266

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  21 packages

  • python312Packages.jupyterlab-git
  • python312Packages.jupyterlab-lsp
  • python312Packages.jupyterlab-vim
  • python313Packages.jupyterlab-git
  • python313Packages.jupyterlab-lsp
  • python313Packages.jupyterlab-vim
  • python314Packages.jupyterlab-git
  • python314Packages.jupyterlab-lsp
  • python314Packages.jupyterlab-vim
  • python312Packages.jupyterlab-server
  • python313Packages.jupyterlab-server
  • python314Packages.jupyterlab-server
  • python312Packages.jupyterlab-widgets
  • python313Packages.jupyterlab-widgets
  • python314Packages.jupyterlab-widgets
  • python312Packages.jupyterlab-pygments
  • python313Packages.jupyterlab-pygments
  • python314Packages.jupyterlab-pygments
  • python312Packages.jupyterlab-execute-time
  • python313Packages.jupyterlab-execute-time
  • python314Packages.jupyterlab-execute-time
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

jupyterlab: Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4 x_refsource_CONFIRM

---

jupyterlab

• ==>= 4.0.0, < 4.5.7

NIXPKGS-2026-1590

GitHub issue published 4 months ago

Permalink CVE-2026-44673

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

libyang: lyb_read_string() integer overflow → heap buffer overflow

• https://github.com/CESNET/libyang/security/advisories/GHSA-vw2p-pq79-92xh x_refsource_CONFIRM

---

libyang

• ==< SO 5.2.15

NIXPKGS-2026-1589

GitHub issue published 4 months ago

Permalink CVE-2026-45371

7.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gmmv-4cc5-wr9r x_refsource_CONFIRM

---

siyuan

• ==< 3.7.0

NIXPKGS-2026-1588

GitHub issue published 4 months ago

Permalink CVE-2026-44426

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check

• https://github.com/shellhub-io/shellhub/security/advisories/GHSA-vwx9-7qcf-gg7f x_refsource_CONFIRM

---

shellhub

• ==< 0.24.2

NIXPKGS-2026-1587

GitHub issue published 4 months ago

Permalink CVE-2026-44424

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace

• https://github.com/shellhub-io/shellhub/security/advisories/GHSA-j72x-xfwg-783f x_refsource_CONFIRM

---

shellhub

• ==< 0.24.2

NIXPKGS-2026-1586

GitHub issue published 4 months ago

Permalink CVE-2026-45033

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  2 packages

  • copilot-cli
  • fishPlugins.github-copilot-cli-fish
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

• https://github.com/github/copilot-cli/security/advisories/GHSA-9ccr-r5hg-74gf exploitx_refsource_CONFIRM

---

copilot-cli

• ==< 1.0.43

NIXPKGS-2026-1585

GitHub issue published 4 months ago

Permalink CVE-2026-42561

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

Python-Multipart: Denial of Service via unbounded multipart part headers

• https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g x_refsource_CONFIRM

---

python-multipart

• ==< 0.0.27