NIXPKGS-2026-2188

GitHub issue published 1 week, 1 day ago

OpenClaw < 2026.6.6 Environment Variable Injection via rustup

Permalink CVE-2026-62203

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw < 2026.6.6 Environment Variable Injection via rustup

• GitHub Security Advisory (GHSA-wxh3-g47h-q3mc) vendor-advisory
• VulnCheck Advisory: OpenClaw < 2026.6.6 Environment Variable Injection via rustup third-party-advisory

---

OpenClaw

• <2026.6.6
• ==2026.6.6

NIXPKGS-2026-2187

GitHub issue published 1 week, 1 day ago

Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero

Permalink CVE-2026-26199

5.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse ignored
  10 packages

  • hdf5-blosc
  • hdf5-fortran
  • hdf5-threadsafe
  • hdf5-fortran-mpi
  • pkgsRocm.hdf5-mpi
  • haskellPackages.hdf5
  • haskellPackages.hdf5-lite
  • pkgsRocm.hdf5-fortran-mpi
  • python313Packages.hdf5plugin
  • python314Packages.hdf5plugin
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero

• https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc exploitx_refsource_CONFIRM
• https://github.com/HDFGroup/hdf5/blob/develop/src/H5Gname.c#L474 x_refsource_MISC

---

hdf5

• ==<= 1.14.6

NIXPKGS-2026-2186

GitHub issue published 1 week, 1 day ago

Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentation

Permalink CVE-2026-15813

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentation

• https://access.redhat.com/security/cve/CVE-2026-15813 x_refsource_REDHATvdb-entry
• RHBZ#2500854 issue-trackingx_refsource_REDHAT

---

rhcos

kronosnet

Fix in 1.35 https://github.com/kronosnet/kronosnet/releases/tag/v1.35

NIXPKGS-2026-2185

GitHub issue published 1 week, 1 day ago

Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header

Permalink CVE-2026-63771

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse ignored package adminerevo 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header

• Researcher Disclosure technical-descriptionexploit
• GitHub Security Advisory (GHSA--c533-9qwm-8w5h) vendor-advisory
• Release Notes release-notes
• https://www.vulncheck.com/advisories/adminer-cookie-injection-via-x-forwarded-p… third-party-advisory

---

adminer

• <5.4.3

NIXPKGS-2026-2184

GitHub issue published 1 week, 1 day ago

SQL injection in syslog-ng SQL destionation driver

Permalink CVE-2026-39879

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

SQL injection in syslog-ng SQL destionation driver

• https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m x_refsource_CONFIRM

---

syslog-ng

• ==< 4.12

NIXPKGS-2026-2183

GitHub issue published 1 week, 1 day ago

filebrowser-quantum: security issues < 1.4.3-beta

Permalink CVE-2026-46410

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse ignored
  3 packages

  • filebrowser
  • python313Packages.filebrowser-safe
  • python314Packages.filebrowser-safe
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

FileBrowser Quantum: unauthenticated user share share info

• https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3jmg-p96m-m328 x_refsource_CONFIRM
• https://github.com/gtsteffaniak/filebrowser/commit/1802e1281135cba83eb4acd86b58293fe121e2a5 x_refsource_MISC

---

filebrowser

• ==< 1.3.2-stable
• ==< 1.4.1-beta

Permalink CVE-2026-54910

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse ignored
  3 packages

  • filebrowser
  • python313Packages.filebrowser-safe
  • python314Packages.filebrowser-safe
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

• https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w exploitx_refsource_CONFIRM
• https://github.com/gtsteffaniak/filebrowser/commit/f3f4bbe80cb569d664174aea874d7bfa008c3b5a x_refsource_MISC

---

filebrowser

• ==< 1.4.3-beta

NIXPKGS-2026-2182

GitHub issue published 1 week, 1 day ago

perlPackages.NetDNS: security issues < 1.56

Permalink CVE-2026-64193

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse ignored
  7 packages

  • perlPackages.NetDNSNative
  • akkuPackages.chibi-net-dns
  • perl5Packages.NetDNSNative
  • perlPackages.NetDNSResolverMock
  • perl5Packages.NetDNSResolverMock
  • perlPackages.NetDNSResolverProgrammable
  • perl5Packages.NetDNSResolverProgrammable
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR

• https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56
• https://rt.cpan.org/Ticket/Display.html?id=179945 issue-tracking
• https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/07/20/12

---

Net-DNS

• =<1.55

Permalink CVE-2026-64194

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse ignored
  7 packages

  • perlPackages.NetDNSNative
  • akkuPackages.chibi-net-dns
  • perl5Packages.NetDNSNative
  • perlPackages.NetDNSResolverMock
  • perl5Packages.NetDNSResolverMock
  • perlPackages.NetDNSResolverProgrammable
  • perl5Packages.NetDNSResolverProgrammable
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains

• https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56
• https://rt.cpan.org/Ticket/Display.html?id=179946 issue-tracking
• https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/07/20/13

---

Net-DNS

• =<1.55

NIXPKGS-2026-2181

GitHub issue published 1 week, 1 day ago

proftpd: security issues < 1.3.9c

Permalink CVE-2026-53994

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse ignored
  2 references

  • Patch Commit
  • Product
  1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation

• https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-… third-party-advisory

Ignored references (2)

• Patch Commit patch
• Product product

---

ProFTPD

• <1.3.10

Fixed in 1.3.9b

https://github.com/proftpd/proftpd/issues/2115

Permalink CVE-2026-63090

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly

• Release Notes release-notes
• v1.3.10rc3 Pre-release Tag release-notes
• v1.3.9c Release Tag release-notes
• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-… third-party-advisory

---

proftpd

• <1.3.9c
• <1.3.10rc3

Permalink CVE-2026-63091

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser

• Release Notes release-notes
• v1.3.10rc3 Pre-release Tag release-notes
• v1.3.9c Release Tag release-notes
• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/proftpd-mod-sftp-signed-integer-overflow-v… third-party-advisory

---

proftpd

• <1.3.9c
• <1.3.10rc3

NIXPKGS-2026-2180

GitHub issue published 1 week, 1 day ago

NanoMQ: QUIC Dialer Close Type Confusion

Permalink CVE-2026-44640

4.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 month, 4 weeks ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

NanoMQ: QUIC Dialer Close Type Confusion

• https://github.com/nanomq/nanomq/security/advisories/GHSA-9fgw-v323-jmjj x_refsource_CONFIRMexploit
• https://github.com/nanomq/nanomq/releases/tag/0.24.14 x_refsource_MISC

---

nanomq

• ==< 0.24.14

NIXPKGS-2026-2179

GitHub issue published 1 week, 1 day ago

NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read

Permalink CVE-2026-35217

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read

• https://github.com/nanomq/nanomq/security/advisories/GHSA-w4xh-p384-w556 exploitx_refsource_CONFIRM

---

nanomq

• ==<= 0.24.14