NIXPKGS-2026-1464

GitHub issue published 4 months ago

Permalink CVE-2026-42575

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

• https://github.com/chainguard-dev/apko/security/advisories/GHSA-hcwr-pq9g-rq3m x_refsource_CONFIRM
• https://github.com/chainguard-dev/apko/commit/a118c3d604107532b5525bd4bee2fb369a6228aa x_refsource_MISC
• https://github.com/chainguard-dev/apko/releases/tag/v1.2.7 x_refsource_MISC

---

apko

• ==< 1.2.7

NIXPKGS-2026-1463

GitHub issue published 4 months ago

Permalink CVE-2026-42246

7.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  4 packages

  • perlPackages.NetIMAPClient
  • perl5Packages.NetIMAPClient
  • perl538Packages.NetIMAPClient
  • perl540Packages.NetIMAPClient
  4 months ago
• @LeSuisse ignored
  6 references

  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/commit…
  • https://github.com/ruby/net-imap/commit…
  • https://github.com/ruby/net-imap/commit…
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

net-imap vulnerable to STARTTLS stripping via invalid response timing

• https://github.com/ruby/net-imap/security/advisories/GHSA-vcgp-9326-pqcp x_refsource_CONFIRM
• https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da x_refsource_MISC

Ignored references (6)

• https://github.com/ruby/net-imap/commit/0ede4c40b1523dfeaf95777b2678e54cc0fd9618 x_refsource_MISC
• https://github.com/ruby/net-imap/commit/24a4e770b43230286a05aa2a9746cdbb3eb8485e x_refsource_MISC
• https://github.com/ruby/net-imap/commit/97e2488fb5401a1783bddd959dde007d9fbce42c x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.3.10 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.4.24 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.5.14 x_refsource_MISC

---

net-imap

• ==< 0.3.10
• ==>= 0.5.0, < 0.5.14
• ==>= 0.6.0, < 0.6.4
• ==>= 0.4.0, < 0.4.24

NIXPKGS-2026-1462

GitHub issue published 4 months ago

Permalink CVE-2026-6665

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored package prometheus-pgbouncer-exporter 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

PgBouncer buffer overflow in SCRAM

• https://www.pgbouncer.org/changelog.html#pgbouncer-125x

---

PgBouncer

• <1.25.2

NIXPKGS-2026-1461

GitHub issue published 4 months ago

Permalink CVE-2026-6666

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored package prometheus-pgbouncer-exporter 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

PgBouncer crash in kill_pool_logins_server_error

• https://www.pgbouncer.org/changelog.html#pgbouncer-125x

---

PgBouncer

• <1.25.2

NIXPKGS-2026-1460

GitHub issue published 4 months ago

Permalink CVE-2026-42245

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  4 packages

  • perlPackages.NetIMAPClient
  • perl5Packages.NetIMAPClient
  • perl538Packages.NetIMAPClient
  • perl540Packages.NetIMAPClient
  4 months ago
• @LeSuisse ignored
  5 references

  • https://github.com/ruby/net-imap/commit…
  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/commit…
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

net-imap: Quadratic complexity when reading response literals

• https://github.com/ruby/net-imap/security/advisories/GHSA-q2mw-fvj9-vvcw x_refsource_CONFIRM
• https://github.com/ruby/net-imap/commit/6091f7d6b1f3514cafbfe39c76f2b5d73de3ca96 x_refsource_MISC

Ignored references (5)

• https://github.com/ruby/net-imap/commit/88d95231fc8afef11c1f074453f7d75b68c9dfda x_refsource_MISC
• https://github.com/ruby/net-imap/commit/de685f91a4a4cc75eb80da898c2bf8af08d34819 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.4.24 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.5.14 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.6.4 x_refsource_MISC

---

net-imap

• ==< 0.4.24
• ==>= 0.5.0, < 0.5.14
• ==>= 0.6.0, < 0.6.4

NIXPKGS-2026-1459

GitHub issue published 4 months ago

Permalink CVE-2026-8187

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): Not Defined (X)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  3 references

  • VDB-362339 | CTI Indicators (IOB, IOC, …
  • Submit #800025 | Open5GS 2.7.7 Denial o…
  • https://github.com/open5gs/open5gs/
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse ignored package open5gs-webui 4 months ago
• @LeSuisse published on GitHub 4 months ago

Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumption

• VDB-362339 | Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumption technical-descriptionvdb-entry
• https://github.com/open5gs/open5gs/issues/4492 issue-tracking

Ignored references (3)

• VDB-362339 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• Submit #800025 | Open5GS 2.7.7 Denial of Service (DoS) (CWE-400) third-party-advisory
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.0
• ==2.7.6
• ==2.7.1
• ==2.7.5
• ==2.7.2
• ==2.7.4
• ==2.7.7
• ==2.7.3

NIXPKGS-2026-1458

GitHub issue published 4 months ago

Permalink CVE-2026-42257

5.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  4 packages

  • perlPackages.NetIMAPClient
  • perl5Packages.NetIMAPClient
  • perl538Packages.NetIMAPClient
  • perl540Packages.NetIMAPClient
  4 months ago
• @LeSuisse ignored
  2 references

  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/releas…
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

net-imap: Command Injection via "raw" arguments to multiple commands

• https://github.com/ruby/net-imap/security/advisories/GHSA-hm49-wcqc-g2xg x_refsource_CONFIRM
• https://github.com/ruby/net-imap/releases/tag/v0.5.14 x_refsource_MISC

Ignored references (2)

• https://github.com/ruby/net-imap/releases/tag/v0.4.24 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.6.4 x_refsource_MISC

---

net-imap

• ==< 0.4.24
• ==>= 0.5.0, < 0.5.14
• ==>= 0.6.0, < 0.6.4

NIXPKGS-2026-1457

GitHub issue published 4 months ago

Permalink CVE-2026-8186

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): Not Defined (X)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  3 references

  • VDB-362338 | CTI Indicators (IOB, IOC, …
  • Submit #800024 | Open5GS 2.7.7 Out-of-b…
  • https://github.com/open5gs/open5gs/
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse ignored package open5gs-webui 4 months ago
• @LeSuisse published on GitHub 4 months ago

Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-of-bounds

• VDB-362338 | Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-of-bounds technical-descriptionvdb-entry
• https://github.com/open5gs/open5gs/issues/4491 issue-tracking
• https://github.com/open5gs/open5gs/pull/4496 patchissue-tracking
• https://github.com/open5gs/open5gs/commit/d5bc487fcf9ea87d2b03f2ef95123af344773… patch

Ignored references (3)

• VDB-362338 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• Submit #800024 | Open5GS 2.7.7 Out-of-bounds Read (CWE-125) / Denial of Service (CWE-400) third-party-advisory
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.7
• ==2.7.3
• ==2.7.5
• ==2.7.1
• ==2.7.0
• ==2.7.4
• ==2.7.6
• ==2.7.2

NIXPKGS-2026-1456

GitHub issue published 4 months ago

Permalink CVE-2026-6667

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored package prometheus-pgbouncer-exporter 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

PgBouncer missing authorization check in KILL_CLIENT admin command

• https://www.pgbouncer.org/changelog.html#pgbouncer-125x

---

PgBouncer

• <1.25.2

NIXPKGS-2026-1455

GitHub issue published 4 months ago

Permalink CVE-2026-42576

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

• https://github.com/chainguard-dev/apko/security/advisories/GHSA-m7hm-vm4x-28jf x_refsource_CONFIRM
• https://github.com/chainguard-dev/apko/commit/6604826b19e36e9bc6e196592800fad93738f4a1 x_refsource_MISC
• https://github.com/chainguard-dev/apko/releases/tag/v1.2.7 x_refsource_MISC

---

apko

• ==< 1.2.7