NIXPKGS-2026-2468

GitHub issue published 1 week, 4 days ago

python3Packages.pypdf: security issues < 6.16.1

Permalink CVE-2026-84311

4.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 4 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 4 days ago
• @LeSuisse ignored
  7 packages

  • capypdf
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python314Packages.pypdfium2
  • python313Packages.pypdfium2
  1 week, 4 days ago
• @LeSuisse accepted 1 week, 4 days ago
• @LeSuisse published on GitHub 1 week, 4 days ago

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-763m-79hh-57f2 x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3966 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942 x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.16.1 x_refsource_MISC

---

pypdf

• ==< 6.16.1

Permalink CVE-2026-84310

4.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 4 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 4 days ago
• @LeSuisse ignored
  7 packages

  • capypdf
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  1 week, 4 days ago
• @LeSuisse accepted 1 week, 4 days ago
• @LeSuisse published on GitHub 1 week, 4 days ago

pypdf: Possible long runtimes/large memory usage when retrieving outlines

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-23w6-3w8w-8484 x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3966 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942 x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.16.1 x_refsource_MISC

---

pypdf

• ==< 6.16.1

Permalink CVE-2026-84309

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 4 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 4 days ago
• @LeSuisse ignored
  7 packages

  • capypdf
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  1 week, 4 days ago
• @LeSuisse accepted 1 week, 4 days ago
• @LeSuisse published on GitHub 1 week, 4 days ago

pypdf: Possible infinite loop for TreeObject.insert_child

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jp53-mhqp-8xcg x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3964 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/c9ba557d565d57c53a0b3a0be06c0a4c29b0559b x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.16.0 x_refsource_MISC

---

pypdf

• ==< 6.16.0

NIXPKGS-2026-2467

GitHub issue published 1 week, 5 days ago

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized …

Permalink CVE-2026-82797

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse ignored package libsForQt5.rlottie-qml 1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized …

• https://github.com/Samsung/rlottie/pull/603

---

rlottie

• <8de0d9e6ca80ffef654965505981727b9fa06a51

NIXPKGS-2026-2466

GitHub issue published 1 week, 5 days ago

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Permalink CVE-2026-82397

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse ignored
  4 packages

  • python313Packages.pytest-tornado
  • python313Packages.sockjs-tornado
  • python314Packages.pytest-tornado
  • python314Packages.sockjs-tornado
  1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4 x_refsource_CONFIRM
• https://github.com/tornadoweb/tornado/pull/3704 x_refsource_MISC
• https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de x_refsource_MISC
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.8 x_refsource_MISC

---

tornado

• ==< 6.5.8

NIXPKGS-2026-2465

GitHub issue published 1 week, 5 days ago

open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free

Permalink CVE-2026-82623

5.5 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse ignored package open62541pp 1 week, 5 days ago
• @LeSuisse ignored reference https://g… 1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free

• VDB-397123 | open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free technical-descriptionvdb-entry
• VDB-397123 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-82623 | CVE Analysis and Report third-party-advisory
• Submit #893207 | open62541 Project open62541 1.5.5 Use After Free third-party-advisoryexploit
• https://github.com/open62541/open62541/issues/8199 issue-trackingexploit

Ignored references (1)

• https://github.com/open62541/open62541/ product

---

open62541

• ==1.5.0
• ==1.5.4
• ==1.5.3
• ==1.5.1
• ==1.5.2
• ==1.5.5

NIXPKGS-2026-2464

GitHub issue published 1 week, 5 days ago

Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

Permalink CVE-2026-62993

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse ignored
  6 packages

  • smarty3-i18n
  • haskellPackages.HSmarty
  • python313Packages.pysmarty2
  • python314Packages.pysmarty2
  • python313Packages.smartypants
  • python314Packages.smartypants
  1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

• https://github.com/smarty-php/smarty/security/advisories/GHSA-cq55-c7wv-pxmq x_refsource_CONFIRM
• https://github.com/smarty-php/smarty/pull/1194 x_refsource_MISC
• https://github.com/smarty-php/smarty/commit/31e06fc087a8b5a9b236c1e5dacc1c2850a2c115 x_refsource_MISC
• https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90 x_refsource_MISC
• https://github.com/smarty-php/smarty/releases/tag/v4.5.7 x_refsource_MISC
• https://github.com/smarty-php/smarty/releases/tag/v5.8.2 x_refsource_MISC

---

smarty

• ==>= 5.0.0, < 5.8.2
• ==< 4.5.7

NIXPKGS-2026-2463

GitHub issue published 1 week, 5 days ago

Typora Mermaid Rendering cross site scripting

Permalink CVE-2026-82805

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

Typora Mermaid Rendering cross site scripting

• VDB-397225 | Typora Mermaid Rendering cross site scripting technical-descriptionvdb-entry
• VDB-397225 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• CVE-2026-82805 | CVE Analysis and Report third-party-advisory
• Submit #863528 | Typora <=1.13.7 Code Injection third-party-advisory
• https://github.com/zzk6th/cve/issues/5 issue-trackingexploit
• https://typora.io/releases/all patch
• https://typora.io/#download patch

---

Typora

• ==1.14.0
• ==1.14.8
• ==1.13.0
• ==1.13.2
• ==1.13.7
• ==1.13.4
• ==1.14.4
• ==1.13.6
• ==1.13.3
• ==1.14.6
• ==1.14.1
• ==1.13.1
• ==1.14.5
• ==1.14.3
• ==1.14.2
• ==1.13.5
• ==1.13.8

Needs a backport.

NIXPKGS-2026-2462

GitHub issue published 1 week, 5 days ago

Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination

Permalink CVE-2026-83497

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse ignored
  18 packages

  • opensearch-cli
  • python313Packages.opensearch-py
  • python314Packages.opensearch-py
  • haskellPackages.amazonka-opensearch
  • python313Packages.mypy-boto3-opensearch
  • python314Packages.mypy-boto3-opensearch
  • grafanaPlugins.grafana-opensearch-datasource
  • python313Packages.pysigma-backend-opensearch
  • python314Packages.pysigma-backend-opensearch
  • haskellPackages.amazonka-opensearchserverless
  • python313Packages.aliyun-python-sdk-opensearch
  • python313Packages.types-aiobotocore-opensearch
  • python314Packages.aliyun-python-sdk-opensearch
  • python314Packages.types-aiobotocore-opensearch
  • python313Packages.mypy-boto3-opensearchserverless
  • python314Packages.mypy-boto3-opensearchserverless
  • python313Packages.types-aiobotocore-opensearchserverless
  • python314Packages.types-aiobotocore-opensearchserverless
  1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination

• https://opensearch.org/artifacts/by-version/#release-3-7-0 patchrelease-notes
• https://opensearch.org/artifacts/by-version/#release-2-19-6 patchrelease-notes
• https://aws.amazon.com/security/security-bulletins/2026-092-aws/ vendor-advisory

---

OpenSearch

• =<3.6

Amazon OpenSearch Service

• =<3.5

NIXPKGS-2026-2461

GitHub issue published 1 week, 5 days ago

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements

Permalink CVE-2026-19873

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse ignored
  4 packages

  • perlPackages.HTMLFormFuMultiForm
  • perl5Packages.HTMLFormFuMultiForm
  • perlPackages.CatalystControllerHTMLFormFu
  • perl5Packages.CatalystControllerHTMLFormFu
  1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements

• https://github.com/FormFu/HTML-FormFu/issues/71 issue-tracking
• https://security.metacpan.org/patches/H/HTML-FormFu/2.08/CVE-2026-19873-r1.patch patch
• http://www.openwall.com/lists/oss-security/2026/08/31/7

---

HTML-FormFu

• =<2.08

NIXPKGS-2026-2460

GitHub issue published 1 week, 5 days ago

pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

Permalink CVE-2026-82393

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse ignored
  5 packages

  • pnpm_8
  • pnpmBuildHook
  • pnpmConfigHook
  • pnpm-fixup-state-db
  • pnpm-shell-completion
  1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

• https://github.com/pnpm/pnpm/security/advisories/GHSA-vq4v-j7r6-jq4m x_refsource_CONFIRM
• https://github.com/pnpm/pnpm/pull/12872 x_refsource_MISC
• https://github.com/pnpm/pnpm/pull/12890 x_refsource_MISC
• https://github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7 x_refsource_MISC
• https://github.com/pnpm/pnpm/commit/78e29fe5583a1e5d69ea05e414eff310f78d5ed9 x_refsource_MISC
• https://github.com/pnpm/pnpm/releases/tag/v10.34.5 x_refsource_MISC
• https://github.com/pnpm/pnpm/releases/tag/v11.11.0 x_refsource_MISC

---

pnpm

• ==>= 11.0.0, < 11.11.0
• ==< 10.34.5

NIXPKGS-2026-2459

GitHub issue published 1 week, 5 days ago

Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

Permalink CVE-2026-72001

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 5 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 5 days ago
• @LeSuisse ignored package pangolin-cli 1 week, 5 days ago
• @LeSuisse accepted 1 week, 5 days ago
• @LeSuisse published on GitHub 1 week, 5 days ago

Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

• Release Notes release-notes
• https://www.vulncheck.com/advisories/pangolin-authentication-bypass-via-share-l… third-party-advisory

---

Pangolin

• <1.22.0