NIXPKGS-2026-1454

GitHub issue published 4 months ago

Permalink CVE-2026-42256

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  4 packages

  • perlPackages.NetIMAPClient
  • perl538Packages.NetIMAPClient
  • perl540Packages.NetIMAPClient
  • perl5Packages.NetIMAPClient
  4 months ago
• @LeSuisse ignored
  4 references

  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/commit…
  • https://github.com/ruby/net-imap/commit…
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

net-imap: Denial of service via high iteration count for `SCRAM-*` authentication

• https://github.com/ruby/net-imap/security/advisories/GHSA-87pf-fpwv-p7m7 x_refsource_CONFIRM
• https://github.com/ruby/net-imap/commit/808001bc45c06f7297a7e96d341279e041a7f7f4 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.5.14 x_refsource_MISC

Ignored references (4)

• https://github.com/ruby/net-imap/commit/158d0b505074397cdb5ceb58935e42dd2bcfa612 x_refsource_MISC
• https://github.com/ruby/net-imap/commit/99f59eab6064955a23debd95410263ad144df758 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.4.24 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.6.4 x_refsource_MISC

---

net-imap

• ==>= 0.4.0, < 0.4.24
• ==>= 0.6.0, < 0.6.4
• ==>= 0.5.0, < 0.5.14

NIXPKGS-2026-1453

GitHub issue published 4 months ago

Permalink CVE-2026-6664

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored package prometheus-pgbouncer-exporter 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

PgBouncer integer overflow in PgBouncer network packet parsing

• https://www.pgbouncer.org/changelog.html#pgbouncer-125x

---

PgBouncer

• <1.25.2

NIXPKGS-2026-1452

GitHub issue published 4 months ago

Permalink CVE-2026-42294

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored reference https://g… 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-jcc8-g2q4-9fxq x_refsource_CONFIRM
• https://github.com/argoproj/argo-workflows/commit/7abb4de6c3599e2d5d960ba4d5de4cf1df109965 x_refsource_MISC
• https://github.com/argoproj/argo-workflows/releases/tag/v3.7.14 x_refsource_MISC

Ignored references (1)

• https://github.com/argoproj/argo-workflows/releases/tag/v4.0.5 x_refsource_MISC

---

argo-workflows

• ==>= 4.0.0, < 4.0.5
• ==< 3.7.14

NIXPKGS-2026-1451

GitHub issue published 4 months ago

Permalink CVE-2026-42258

5.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored
  2 references

  • https://github.com/ruby/net-imap/releas…
  • https://github.com/ruby/net-imap/releas…
  4 months ago
• @LeSuisse ignored
  4 packages

  • perl540Packages.NetIMAPClient
  • perl538Packages.NetIMAPClient
  • perl5Packages.NetIMAPClient
  • perlPackages.NetIMAPClient
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

net-imap: Command Injection via unvalidated Symbol inputs

• https://github.com/ruby/net-imap/security/advisories/GHSA-75xq-5h9v-w6px x_refsource_CONFIRM
• https://github.com/ruby/net-imap/releases/tag/v0.5.14 x_refsource_MISC

Ignored references (2)

• https://github.com/ruby/net-imap/releases/tag/v0.4.24 x_refsource_MISC
• https://github.com/ruby/net-imap/releases/tag/v0.6.4 x_refsource_MISC

---

net-imap

• ==< 0.4.24
• ==>= 0.5.0, < 0.5.14
• ==>= 0.6.0, < 0.6.4

NIXPKGS-2026-1450

GitHub issue published 4 months ago

Permalink CVE-2026-42574

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored reference https://g… 4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

• https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6 x_refsource_CONFIRM
• https://github.com/chainguard-dev/apko/pull/2187 x_refsource_MISC
• https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442 x_refsource_MISC

Ignored references (1)

• https://github.com/chainguard-dev/apko/releases/tag/v1.2.5 x_refsource_MISC

---

apko

• ==>= 0.14.8, < 1.2.5

NIXPKGS-2026-1449

GitHub issue published 4 months ago

Permalink CVE-2026-8120

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored package open5gs-webui 4 months ago
• @LeSuisse ignored
  3 references

  • VDB-361907 | CTI Indicators (IOB, IOC, …
  • Submit #808421 | Open5gs NSSF v2.7.7 De…
  • https://github.com/open5gs/open5gs/
  4 months ago
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

Open5GS NSSF nnssf-handler.c denial of service

• VDB-361907 | Open5GS NSSF nnssf-handler.c denial of service technical-descriptionvdb-entry
• https://github.com/open5gs/open5gs/issues/4432 issue-trackingexploit

Ignored references (3)

• VDB-361907 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• Submit #808421 | Open5gs NSSF v2.7.7 Denial of Service third-party-advisoryexploit
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.0
• ==2.7.6
• ==2.7.1
• ==2.7.5
• ==2.7.2
• ==2.7.4
• ==2.7.7
• ==2.7.3

NIXPKGS-2026-1448

GitHub issue published 4 months ago

Permalink CVE-2026-41163

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

• Created suggestion 4 months ago
• @LeSuisse ignored reference https://g… 4 months ago
• @LeSuisse ignored maintainer @dotlambda 4 months ago maintainer.ignore
• @LeSuisse accepted 4 months ago
• @LeSuisse published on GitHub 4 months ago

bubblewrap vulnerable to privilege escalation in setuid mode via ptrace

• https://github.com/containers/bubblewrap/security/advisories/GHSA-xq78-7hw4-5jvp x_refsource_CONFIRM

Ignored references (1)

• https://github.com/containers/bubblewrap/releases/tag/v0.11.2 x_refsource_MISC

---

bubblewrap

• ==>= 0.11.0, < 0.11.2

NIXPKGS-2026-1447

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-44243

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored reference https://g… 4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24 exploitx_refsource_CONFIRM

Ignored references (1)

• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48 x_refsource_MISC

---

GitPython

• ==< 3.1.48

NIXPKGS-2026-1446

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-41653

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration

• https://github.com/alam00000/bentopdf/security/advisories/GHSA-6vh8-4frx-647f x_refsource_CONFIRM
• https://github.com/alam00000/bentopdf/releases/tag/v2.8.3 x_refsource_MISC

---

bentopdf

• ==< 2.8.3

NIXPKGS-2026-1445

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-42217

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • openexr_2
  • openexrid-unstable
  • haskellPackages.openexr-write
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

OpenEXR: Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m x_refsource_CONFIRM
• https://github.com/AcademySoftwareFoundation/openexr/pull/2378 x_refsource_MISC
• https://github.com/AcademySoftwareFoundation/openexr/commit/21eaa33bcbbb0c83a5fc42f6b6d65b70a996e63c x_refsource_MISC

---

openexr

• ==>= 3.0.0, < 3.2.9
• ==>= 3.4.0, < 3.4.11
• ==>= 3.3.0, < 3.3.11