NIXPKGS-2026-1434

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-41684

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • incus-ui-canonical
  • terraform-providers.incus
  • terraform-providers.lxc_incus
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Incus: Nil Dereferences on Restore via Malformed YAML

• https://github.com/lxc/incus/security/advisories/GHSA-x5r6-jr56-89pv x_refsource_CONFIRM
• https://github.com/lxc/incus/releases/tag/v7.0.0 x_refsource_MISC

---

incus

• ==< 7.0.0

NIXPKGS-2026-1433

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-44263

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  8 packages

  • python313Packages.weblate-fonts
  • python314Packages.weblate-fonts
  • python312Packages.weblate-schemas
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python312Packages.weblate-language-data
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  4 months, 1 week ago
• @LeSuisse ignored reference https://g… 4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Weblate: Private Translation Enumeration via Screenshot API

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gcg5-86jr-f7jg x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/pull/19258 x_refsource_MISC
• https://github.com/WeblateOrg/weblate/commit/6cf892c7bd50b667a65a99d716a90694f7d9f203 x_refsource_MISC

Ignored references (1)

• https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1 x_refsource_MISC

---

weblate

• ==< 5.17.1

NIXPKGS-2026-1432

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-44244

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored reference https://g… 4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67 x_refsource_CONFIRMexploit

Ignored references (1)

• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49 x_refsource_MISC

---

GitPython

• ==< 3.1.49

NIXPKGS-2026-1431

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-41519

4.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  8 packages

  • python313Packages.weblate-fonts
  • python314Packages.weblate-fonts
  • python312Packages.weblate-schemas
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python312Packages.weblate-language-data
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  4 months, 1 week ago
• @LeSuisse ignored reference https://g… 4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Weblate's API Token Not Invalidated on Password Change

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6j8j-4qp3-36p2 x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/pull/19057 x_refsource_MISC
• https://github.com/WeblateOrg/weblate/commit/649a2da81700542f95c0807b3c625fc3bb0eaf95 x_refsource_MISC

Ignored references (1)

• https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1 x_refsource_MISC

---

weblate

• ==< 5.17.1

NIXPKGS-2026-1430

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-40195

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • incus-ui-canonical
  • terraform-providers.incus
  • terraform-providers.lxc_incus
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Incus nil-pointer dereference in storage bucket import allows denial of service

• https://github.com/lxc/incus/security/advisories/GHSA-gc7j-g665-rxr9 x_refsource_CONFIRM

---

incus

• ==< 7.0.0

NIXPKGS-2026-1429

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-29080

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API

• https://github.com/rucio/rucio/security/advisories/GHSA-vjr5-c9qv-hgm3 x_refsource_CONFIRM

---

rucio

• ==>= 40.0.0, < 40.1.1
• ==>= 1.27.0, < 35.8.5
• ==>= 38.6.0, < 39.4.2
• ==>= 35.9.0, < 38.5.5

NIXPKGS-2026-1428

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-40251

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored package incus-ui-canonical 4 months, 1 week ago
• @LeSuisse ignored reference https://g… 4 months, 1 week ago
• @LeSuisse ignored
  2 packages

  • terraform-providers.incus
  • terraform-providers.lxc_incus
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Incus out-of-bounds panic in snapshot metadata handling allows denial of service

• https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6 x_refsource_CONFIRM

Ignored references (1)

• https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go x_refsource_MISC

---

incus

• ==< 7.0.0

NIXPKGS-2026-1427

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-5081

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  2 references

  • https://metacpan.org/pod/Apache::Sessio…
  • https://httpd.apache.org/docs/current/m…
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure

• http://www.openwall.com/lists/oss-security/2026/05/06/6

Ignored references (2)

• https://httpd.apache.org/docs/current/mod/mod_unique_id.html technical-description
• https://metacpan.org/pod/Apache::Session::Generate::Random

---

Apache-Session

• =<1.94

NIXPKGS-2026-1426

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-23926

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  55 packages

  • zabbixctl
  • zabbix-cli
  • zabbix60.web
  • zabbix.agent
  • zabbix.web
  • zabbix.agent2
  • zabbix.server
  • zabbix60.agent
  • zabbix70.agent
  • zabbix72.agent
  • zabbix74.agent
  • zabbix60.agent2
  • zabbix60.server
  • zabbix70.agent2
  • zabbix70.server
  • zabbix72.agent2
  • zabbix72.proxy-pgsql
  • zabbix70.proxy-sqlite
  • zabbix70.server-mysql
  • zabbix70.server-pgsql
  • zabbix72.proxy-sqlite
  • zabbix72.server-mysql
  • zabbix72.server-pgsql
  • zabbix74.proxy-sqlite
  • zabbix74.server-mysql
  • zabbix74.server-pgsql
  • python312Packages.pyzabbix
  • python313Packages.pyzabbix
  • python314Packages.pyzabbix
  • python312Packages.py-zabbix
  • python313Packages.py-zabbix
  • python314Packages.py-zabbix
  • python312Packages.zabbix-utils
  • python313Packages.zabbix-utils
  • python314Packages.zabbix-utils
  • zabbix-agent2-plugin-postgresql
  • zabbix60.proxy-sqlite
  • zabbix60.server-mysql
  • zabbix60.server-pgsql
  • zabbix.proxy-sqlite
  • zabbix.server-mysql
  • zabbix.server-pgsql
  • zabbix60.proxy-mysql
  • zabbix60.proxy-pgsql
  • zabbix70.proxy-mysql
  • zabbix70.proxy-pgsql
  • zabbix72.proxy-mysql
  • zabbix74.proxy-mysql
  • zabbix74.proxy-pgsql
  • zabbix.proxy-mysql
  • zabbix74.server
  • zabbix72.server
  • zabbix74.agent2
  • zabbix.proxy-pgsql
  • zabbix74.web
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

Stored XSS vulnerability in Host navigator widget maintenance tooltip

• https://support.zabbix.com/browse/ZBX-27758

---

Zabbix

• =<7.4.7
• =<7.0.23

NIXPKGS-2026-1425

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-44405

3.4 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 4 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 4 months, 1 week ago
• @LeSuisse ignored
  2 packages

  • python313Packages.types-paramiko
  • python314Packages.types-paramiko
  4 months, 1 week ago
• @LeSuisse accepted 4 months, 1 week ago
• @LeSuisse published on GitHub 4 months, 1 week ago

In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 …

• https://github.com/paramiko/paramiko/commit/a4489456b6f65281e172380cc4826cee5e8…
• https://ostif.org/wp-content/uploads/2026/05/25-11-2415-REP_paramiko-security-a…

---

Paramiko

• <a4489456b6f65281e172380cc4826cee5e851dbb