NIXPKGS-2026-1444

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-42216

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • openexr_2
  • openexrid-unstable
  • haskellPackages.openexr-write
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-65j8-95g9-jgj4 exploitx_refsource_CONFIRM

---

openexr

• ==>= 3.3.0, < 3.3.11
• ==>= 3.0.0, < 3.2.9
• ==>= 3.4.0, < 3.4.11

NIXPKGS-2026-1443

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-41654

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored reference https://g… 4 months, 1 week ago
• @LeSuisse ignored
  8 packages

  • python313Packages.weblate-fonts
  • python314Packages.weblate-fonts
  • python312Packages.weblate-schemas
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python312Packages.weblate-language-data
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9g x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/pull/19061 x_refsource_MISC
• https://github.com/WeblateOrg/weblate/pull/19062 x_refsource_MISC
• https://github.com/WeblateOrg/weblate/commit/e1eff1f517c1ee315d69581910baaabb724e5ef0 x_refsource_MISC
• https://github.com/WeblateOrg/weblate/commit/e4b67a76d95d5165ecb9937f7485fd79223b7f14 x_refsource_MISC

Ignored references (1)

• https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1 x_refsource_MISC

---

weblate

• ==< 5.17.1

NIXPKGS-2026-1442

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-41648

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • incus-ui-canonical
  • terraform-providers.incus
  • terraform-providers.lxc_incus
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Incus: Unbounded YAML Metadata Decode via Parsing

• https://github.com/lxc/incus/security/advisories/GHSA-67wx-r9xr-x75x x_refsource_CONFIRMexploit
• https://github.com/lxc/incus/releases/tag/v7.0.0 x_refsource_MISC

---

incus

• ==< 7.0.0

NIXPKGS-2026-1441

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-41413

5.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored reference https://g… 4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Istio Vulnerable to SSRF via RequestAuthentication jwksUri

• https://github.com/istio/istio/security/advisories/GHSA-fgw5-hp8f-xfhc x_refsource_CONFIRM
• https://github.com/istio/istio/releases/tag/1.28.6 x_refsource_MISC

Ignored references (1)

• https://github.com/istio/istio/releases/tag/1.29.2 x_refsource_MISC

---

istio

• ==< 1.28.6
• ==>= 1.29.0-alpha.0, < 1.29.2

NIXPKGS-2026-1440

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-42215

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored reference https://g… 4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

GitPython: Command injection via Git options bypass

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4 x_refsource_CONFIRM

Ignored references (1)

• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47 x_refsource_MISC

---

GitPython

• ==>= 3.1.30, < 3.1.47

NIXPKGS-2026-1439

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-42284

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored reference https://g… 4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

GitPython: Unsafe option check validates multi_options before shlex.split transforms it

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485 x_refsource_CONFIRM

Ignored references (1)

• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47 x_refsource_MISC

---

GitPython

• ==< 3.1.47

NIXPKGS-2026-1438

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-44264

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored package python313Packages.weblate-fonts 4 months, 1 week ago
• @LeSuisse ignored reference https://g… 4 months, 1 week ago
• @LeSuisse ignored
  7 packages

  • python314Packages.weblate-fonts
  • python312Packages.weblate-schemas
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python312Packages.weblate-language-data
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Weblate is vulnerable to XSS via crafted Markdown

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-5cmv-3rc4-7279 x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/pull/19259 x_refsource_MISC
• https://github.com/WeblateOrg/weblate/commit/85abc9df88b7464f4c0e794aef752e45f4230f75 x_refsource_MISC

Ignored references (1)

• https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1 x_refsource_MISC

---

weblate

• ==< 5.17.1

NIXPKGS-2026-1437

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-41685

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • incus-ui-canonical
  • terraform-providers.incus
  • terraform-providers.lxc_incus
  4 months, 1 week ago
• @LeSuisse ignored reference https://g… 4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Incus: Unbounded binary import disk exhaustion

• https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp x_refsource_CONFIRMexploit

Ignored references (1)

• https://github.com/lxc/incus/releases/tag/v7.0.0 x_refsource_MISC

---

incus

• ==< 7.0.0

NIXPKGS-2026-1436

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-41647

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • incus-ui-canonical
  • terraform-providers.incus
  • terraform-providers.lxc_incus
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Incus: Nil-Pointer Dereference via S3 Bucket Import

• https://github.com/lxc/incus/security/advisories/GHSA-fwj8-62r8-8p8m x_refsource_CONFIRM
• https://github.com/lxc/incus/releases/tag/v7.0.0 x_refsource_MISC

---

incus

• ==< 7.0.0

NIXPKGS-2026-1435

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-41142

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • openexrid-unstable
  • haskellPackages.openexr-write
  • openexr_2
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API

• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-m25w-72cj-q6mg x_refsource_CONFIRM
• https://github.com/AcademySoftwareFoundation/openexr/pull/2367 x_refsource_MISC
• https://github.com/AcademySoftwareFoundation/openexr/commit/0592ee539f33c122c90f09238579b902d838afb4 x_refsource_MISC

---

openexr

• ==>= 3.0.0, < 3.2.9
• ==>= 3.4.0, < 3.4.11
• ==>= 3.3.0, < 3.3.11