NIXPKGS-2026-1274

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41425

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  15 packages

  • python312Packages.oauthlib
  • python313Packages.oauthlib
  • python314Packages.oauthlib
  • python312Packages.hawkauthlib
  • python313Packages.hawkauthlib
  • python314Packages.hawkauthlib
  • python312Packages.aiohttp-oauthlib
  • python313Packages.aiohttp-oauthlib
  • python314Packages.aiohttp-oauthlib
  • python312Packages.requests-oauthlib
  • python313Packages.requests-oauthlib
  • python314Packages.requests-oauthlib
  • python312Packages.google-auth-oauthlib
  • python313Packages.google-auth-oauthlib
  • python314Packages.google-auth-oauthlib
  4 months, 2 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

Authlib: Cross-site request forging when using cache

• https://github.com/authlib/authlib/security/advisories/GHSA-jj8c-mmj3-mmgv x_refsource_CONFIRM

---

authlib

• ==< 1.6.11

NIXPKGS-2026-1272

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41488

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding

• https://github.com/langchain-ai/langchain/security/advisories/GHSA-r7w7-9xr2-qq2r x_refsource_CONFIRM

---

langchain-openai

• ==< 1.1.14

NIXPKGS-2026-1273

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41421

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

SiYuan Desktop Notification XSS Leads to Electron RCE

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-grjj-6f6g-cq8q x_refsource_CONFIRM

---

siyuan

• ==< 3.6.5

NIXPKGS-2026-1270

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-40254

4.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx exploitx_refsource_CONFIRM

---

FreeRDP

• ==< 3.25.0

NIXPKGS-2026-1271

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41066

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  9 packages

  • python312Packages.types-lxml
  • python313Packages.types-lxml
  • python314Packages.types-lxml
  • python312Packages.lxml-html-clean
  • python313Packages.lxml-html-clean
  • python314Packages.lxml-html-clean
  • python312Packages.readability-lxml
  • python313Packages.readability-lxml
  • python314Packages.readability-lxml
  4 months, 2 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

• https://github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfw x_refsource_CONFIRM
• https://bugs.launchpad.net/lxml/+bug/2146291 x_refsource_MISC

---

lxml

• ==< 6.1.0

NIXPKGS-2026-1269

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41068

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored package kyverno-chainsaw 4 months, 2 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)

• https://github.com/kyverno/kyverno/security/advisories/GHSA-cvq5-hhx3-f99p x_refsource_CONFIRMexploit
• https://github.com/kyverno/kyverno/commit/bbf3e5c01391d612968440659028ae98e565a777 x_refsource_MISC

---

kyverno

• ==< 1.17.2

NIXPKGS-2026-1268

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-29051

4.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  6 packages

  • ocamlPackages.melange
  • ocamlPackages.melange-json
  • ocamlPackages_latest.melange
  • ocamlPackages.melange-json-native
  • ocamlPackages_latest.melange-json
  • ocamlPackages_latest.melange-json-native
  4 months, 2 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

melange has Path Traversal via .PKGINFO in --persist-lint-results

• https://github.com/chainguard-dev/melange/security/advisories/GHSA-q2pw-xx38-p64j x_refsource_CONFIRM
• https://github.com/chainguard-dev/melange/commit/84f3b450ce6e472c4abb8dc4c26d0ce8ac1259ac x_refsource_MISC

---

melange

• ==>= 0.32.0, < 0.43.4

NIXPKGS-2026-1267

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41485

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored package kyverno-chainsaw 4 months, 2 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

Kyverno Controller Denial of Service via forEach Mutation Panic

• https://github.com/kyverno/kyverno/security/advisories/GHSA-fpjq-c37h-cqcv x_refsource_CONFIRMexploit
• https://github.com/kyverno/kyverno/commit/76c8fdbe87328722e099e1fd44c3f21c9f7809cb x_refsource_MISC

Ignored references (1)

• https://github.com/kyverno/kyverno/commit/80e728c2283a0c65e5adb02d8a907106e6ebe7e3 x_refsource_MISC

---

kyverno

• ==< 1.16.4
• ==>= 1.17.0-rc1, < 1.17.2

NIXPKGS-2026-1264

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41492

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  5 packages

  • coqPackages.dpdgraph
  • perlPackages.GDGraph
  • perl5Packages.GDGraph
  • perl538Packages.GDGraph
  • perl540Packages.GDGraph
  4 months, 2 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q exploitx_refsource_CONFIRM
• https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3 x_refsource_MISC

---

dgraph

• ==< 25.3.3

NIXPKGS-2026-1266

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-40690

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users

• https://github.com/apache/airflow/pull/65273 patch
• https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/04/24/4

---

apache-airflow

• <3.2.1