NIXPKGS-2026-1564

GitHub issue published 4 months ago

Permalink CVE-2026-7471

3.5 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  44 packages

  • gitlab-art
  • gitlab-duo
  • gitlab-kas
  • gitlab-ci-ls
  • gitlab-pages
  • gitlab-shell
  • danger-gitlab
  • gitlab-clippy
  • gitlab-runner
  • gitlab-triage
  • gitlab-ci-local
  • gitlab-timelogs
  • gitlab-ci-linter
  • gitlab-workhorse
  • gitlab-release-cli
  • ocamlPackages.gitlab
  • vimPlugins.gitlab-vim
  • gitlab-container-registry
  • ocamlPackages.gitlab-jsoo
  • ocamlPackages.gitlab-unix
  • rubyPackages.gitlab-markup
  • terraform-providers.gitlab
  • ocamlPackages_latest.gitlab
  • gitlab-elasticsearch-indexer
  • haskellPackages.gitlab-haskell
  • rubyPackages_3_3.gitlab-markup
  • rubyPackages_3_4.gitlab-markup
  • rubyPackages_4_0.gitlab-markup
  • python312Packages.mkdocs-gitlab
  • python312Packages.python-gitlab
  • python313Packages.mkdocs-gitlab
  • python313Packages.python-gitlab
  • python314Packages.mkdocs-gitlab
  • python314Packages.python-gitlab
  • ocamlPackages_latest.gitlab-jsoo
  • ocamlPackages_latest.gitlab-unix
  • terraform-providers.gitlabhq_gitlab
  • gnomeExtensions.gitlab-time-tracking
  • prometheus-gitlab-ci-pipelines-exporter
  • vscode-extensions.gitlab.gitlab-workflow
  • perlPackages.AlienBuildPluginDownloadGitLab
  • perl5Packages.AlienBuildPluginDownloadGitLab
  • perl538Packages.AlienBuildPluginDownloadGitLab
  • perl540Packages.AlienBuildPluginDownloadGitLab
  4 months ago
• @LeSuisse ignored
  5 maintainers

  • @globin
  • @krav
  • @yayayayaka
  • @leona-ya
  • @talyz
  4 months ago maintainer.ignore
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

Server-Side Request Forgery (SSRF) in GitLab

• https://gitlab.com/gitlab-org/gitlab/-/work_items/594196
• https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-relea…

---

GitLab

• <18.9.7
• <18.11.3
• <18.10.6

NIXPKGS-2026-1563

GitHub issue published 4 months ago

Permalink CVE-2026-43909

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  4 packages

  • colmap
  • colmapWithCuda
  • python313Packages.openimageio
  • python314Packages.openimageio
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder

• https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-g267-j53j-5258 x_refsource_CONFIRMexploit

---

OpenImageIO

• ==>= 3.1.4.0-beta, < 3.1.13.0
• ==< 3.0.18.0

NIXPKGS-2026-1562

GitHub issue published 4 months ago

Permalink CVE-2026-24000

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  19 packages

  • azure-cli-extensions.fleet
  • python312Packages.tesla-fleet-api
  • python313Packages.tesla-fleet-api
  • python314Packages.tesla-fleet-api
  • haskellPackages.amazonka-iotfleethub
  • haskellPackages.amazonka-iotfleetwise
  • python312Packages.mypy-boto3-iotfleethub
  • python313Packages.mypy-boto3-iotfleethub
  • python314Packages.mypy-boto3-iotfleethub
  • python312Packages.mypy-boto3-iotfleetwise
  • python313Packages.mypy-boto3-iotfleetwise
  • python314Packages.mypy-boto3-iotfleetwise
  • home-assistant-component-tests.tesla_fleet
  • python312Packages.types-aiobotocore-iotfleethub
  • python313Packages.types-aiobotocore-iotfleethub
  • python312Packages.types-aiobotocore-iotfleetwise
  • python313Packages.types-aiobotocore-iotfleetwise
  • fleetctl
  • fleeting-plugin-aws
  4 months ago
• @LeSuisse ignored
  2 maintainers

  • @LeSuisse
  • @asauzeau
  4 months ago maintainer.ignore
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

Fleet has a rate limiting bypass via untrusted client IP headers

• https://github.com/fleetdm/fleet/security/advisories/GHSA-j8h8-75h3-jg53 x_refsource_CONFIRM
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.80.1 x_refsource_MISC

---

fleet

• ==< 4.80.1

NIXPKGS-2026-1561

GitHub issue published 4 months ago

Permalink CVE-2026-26062

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  19 packages

  • fleetctl
  • python312Packages.types-aiobotocore-iotfleethub
  • python313Packages.types-aiobotocore-iotfleethub
  • python312Packages.types-aiobotocore-iotfleetwise
  • python313Packages.types-aiobotocore-iotfleetwise
  • home-assistant-component-tests.tesla_fleet
  • python314Packages.mypy-boto3-iotfleetwise
  • python313Packages.mypy-boto3-iotfleetwise
  • python314Packages.mypy-boto3-iotfleethub
  • python312Packages.mypy-boto3-iotfleethub
  • haskellPackages.amazonka-iotfleetwise
  • python314Packages.tesla-fleet-api
  • python313Packages.tesla-fleet-api
  • python312Packages.tesla-fleet-api
  • azure-cli-extensions.fleet
  • fleeting-plugin-aws
  • haskellPackages.amazonka-iotfleethub
  • python313Packages.mypy-boto3-iotfleethub
  • python312Packages.mypy-boto3-iotfleetwise
  4 months ago
• @LeSuisse ignored
  2 maintainers

  • @LeSuisse
  • @asauzeau
  4 months ago maintainer.ignore
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

Fleet server may terminate unexpectedly when handling certain gRPC requests

• https://github.com/fleetdm/fleet/security/advisories/GHSA-x67p-9m2r-fxqv x_refsource_CONFIRM
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.0 x_refsource_MISC

---

fleet

• ==< 4.81.0

NIXPKGS-2026-1560

GitHub issue published 4 months ago

Permalink CVE-2026-23998

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  19 packages

  • fleetctl
  • python312Packages.tesla-fleet-api
  • python313Packages.tesla-fleet-api
  • python314Packages.tesla-fleet-api
  • haskellPackages.amazonka-iotfleethub
  • haskellPackages.amazonka-iotfleetwise
  • python312Packages.mypy-boto3-iotfleethub
  • python313Packages.mypy-boto3-iotfleethub
  • python314Packages.mypy-boto3-iotfleethub
  • python312Packages.mypy-boto3-iotfleetwise
  • python313Packages.mypy-boto3-iotfleetwise
  • python314Packages.mypy-boto3-iotfleetwise
  • home-assistant-component-tests.tesla_fleet
  • python312Packages.types-aiobotocore-iotfleethub
  • python313Packages.types-aiobotocore-iotfleethub
  • python312Packages.types-aiobotocore-iotfleetwise
  • python313Packages.types-aiobotocore-iotfleetwise
  • azure-cli-extensions.fleet
  • fleeting-plugin-aws
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

Fleet has a Windows MDM management endpoint authentication bypass

• https://github.com/fleetdm/fleet/security/advisories/GHSA-2rc4-7jc6-qffh x_refsource_CONFIRM
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.0 x_refsource_MISC

---

fleet

• ==< 4.81.0

NIXPKGS-2026-1559

GitHub issue published 4 months ago

Permalink CVE-2026-26191

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  19 packages

  • fleeting-plugin-aws
  • azure-cli-extensions.fleet
  • python312Packages.tesla-fleet-api
  • python313Packages.tesla-fleet-api
  • python314Packages.tesla-fleet-api
  • haskellPackages.amazonka-iotfleethub
  • haskellPackages.amazonka-iotfleetwise
  • python312Packages.mypy-boto3-iotfleethub
  • python313Packages.mypy-boto3-iotfleethub
  • python314Packages.mypy-boto3-iotfleethub
  • python312Packages.mypy-boto3-iotfleetwise
  • python313Packages.mypy-boto3-iotfleetwise
  • python314Packages.mypy-boto3-iotfleetwise
  • home-assistant-component-tests.tesla_fleet
  • python312Packages.types-aiobotocore-iotfleethub
  • fleetctl
  • python313Packages.types-aiobotocore-iotfleethub
  • python313Packages.types-aiobotocore-iotfleetwise
  • python312Packages.types-aiobotocore-iotfleetwise
  4 months ago
• @LeSuisse ignored
  2 maintainers

  • @LeSuisse
  • @asauzeau
  4 months ago maintainer.ignore
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

Fleet vulnerable to OS command injection in software packages

• https://github.com/fleetdm/fleet/security/advisories/GHSA-9vcr-g537-3w5v x_refsource_CONFIRM
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.1 x_refsource_MISC

---

fleet

• ==< 4.81.1

NIXPKGS-2026-1558

GitHub issue published 4 months ago

Permalink CVE-2026-46356

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  19 packages

  • fleeting-plugin-aws
  • azure-cli-extensions.fleet
  • python312Packages.tesla-fleet-api
  • python313Packages.tesla-fleet-api
  • python314Packages.tesla-fleet-api
  • haskellPackages.amazonka-iotfleethub
  • haskellPackages.amazonka-iotfleetwise
  • python312Packages.mypy-boto3-iotfleethub
  • python313Packages.mypy-boto3-iotfleethub
  • python314Packages.mypy-boto3-iotfleethub
  • python312Packages.mypy-boto3-iotfleetwise
  • python313Packages.mypy-boto3-iotfleetwise
  • python314Packages.mypy-boto3-iotfleetwise
  • home-assistant-component-tests.tesla_fleet
  • python312Packages.types-aiobotocore-iotfleethub
  • python313Packages.types-aiobotocore-iotfleethub
  • python312Packages.types-aiobotocore-iotfleetwise
  • python313Packages.types-aiobotocore-iotfleetwise
  • fleetctl
  4 months ago
• @LeSuisse ignored
  2 maintainers

  • @LeSuisse
  • @asauzeau
  4 months ago maintainer.ignore
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

Fleet: IP spoofing allows bypassing API rate limiting

• https://github.com/fleetdm/fleet/security/advisories/GHSA-mxmp-wr3w-rvqx x_refsource_CONFIRM
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.80.1 x_refsource_MISC

---

fleet

• ==< 4.80.1

NIXPKGS-2026-1557

GitHub issue published 4 months ago

Permalink CVE-2026-44245

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored package kyverno-chainsaw 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component

• https://github.com/kyverno/kyverno/security/advisories/GHSA-q98m-7w8c-w388 x_refsource_CONFIRM

---

kyverno

• ==< 2.5.2

NIXPKGS-2026-1556

GitHub issue published 4 months ago

Permalink CVE-2026-44222

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

vLLM: Remote DoS via Special-Token Placeholders

• https://github.com/vllm-project/vllm/security/advisories/GHSA-hpv8-x276-m59f x_refsource_CONFIRM
• https://github.com/vllm-project/vllm/issues/32656 x_refsource_MISC

---

vllm

• ==>= 0.6.1, < 0.20.0

NIXPKGS-2026-1555

GitHub issue published 4 months ago

Permalink CVE-2026-5089

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

YAML::Syck versions before 1.38 for Perl has an out-of-bounds read

• https://metacpan.org/release/TODDR/YAML-Syck-1.38/changes release-notes
• https://github.com/cpan-authors/YAML-Syck/issues/132 issue-tracking
• https://github.com/cpan-authors/YAML-Syck/pull/133 issue-tracking
• https://github.com/cpan-authors/YAML-Syck/commit/208a4d3bd1b5cdb4a791a6e3905bd6… patch
• http://www.openwall.com/lists/oss-security/2026/05/12/16

---

YAML-Syck

• <1.38