NIXPKGS-2026-1262

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41481

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

• https://github.com/langchain-ai/langchain/security/advisories/GHSA-fv5p-p927-qmxr x_refsource_CONFIRM

---

langchain-text-splitters

• ==< 1.1.2

NIXPKGS-2026-1265

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-25660

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

Authentication bypass for certain API calls

• https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645 vendor-advisory

---

CodeChecker

• =<6.27.3

NIXPKGS-2026-1261

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41894

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hjh7-r5w8-5872 x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7 x_refsource_MISC

Ignored references (1)

• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.5 x_refsource_MISC

---

siyuan

• ==< 3.6.5

NIXPKGS-2026-1263

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-38743

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities

• https://github.com/apache/airflow/pull/64822 patch
• https://lists.apache.org/thread/sk2wj0x48o8qb4p7c47gvnhjbm0mg396 vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/04/24/3

---

apache-airflow

• <3.2.1

NIXPKGS-2026-1260

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-42095

4.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

bookserver in KDE Arianna before 26.04.1 allows attackers to read …

• https://kde.org/info/security/advisory-20260424-1.txt
• https://invent.kde.org/graphics/arianna/-/commit/485851d25de279a9d2711d37804435…
• https://invent.kde.org/graphics/arianna/-/commit/3cd56fce103ab62887c5592827d78a…

Ignored references (1)

• https://github.com/KDE/arianna/tags

---

Arianna

• <26.04.1

NIXPKGS-2026-1259

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41327

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  5 packages

  • coqPackages.dpdgraph
  • perlPackages.GDGraph
  • perl5Packages.GDGraph
  • perl538Packages.GDGraph
  • perl540Packages.GDGraph
  4 months, 2 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77 x_refsource_CONFIRMexploit
• https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3 x_refsource_MISC

---

dgraph

• ==< 25.3.3

NIXPKGS-2026-1258

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41305

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  2 packages

  • nodePackages.postcss
  • nodePackages_latest.postcss
  4 months, 2 weeks ago
• @LeSuisse restored
  2 packages

  • nodePackages.postcss
  • nodePackages_latest.postcss
  4 months, 2 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

• https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93 x_refsource_CONFIRMexploit

Ignored references (1)

• https://github.com/postcss/postcss/releases/tag/8.5.10 x_refsource_MISC

---

postcss

• ==< 8.5.10

NIXPKGS-2026-1257

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41476

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

Deskflow: clipboard deserialization global-buffer-overflow

• https://github.com/deskflow/deskflow/security/advisories/GHSA-3jp5-g964-cgmh x_refsource_CONFIRMexploit

---

deskflow

• ==< 1.26.0.138

NIXPKGS-2026-1256

GitHub issue published 4 months, 2 weeks ago

Permalink CVE-2026-41079

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  72 packages

  • apcupsd
  • cups-bjnp
  • cups-dymo
  • carps-cups
  • cups-zj-58
  • cups-browsed
  • cups-filters
  • cups-kyocera
  • cups-printers
  • gutenprintBin
  • cups-kyodialog
  • cups-pk-helper
  • gutenprint-bin
  • libcupsfilters
  • canon-cups-ufr2
  • cups-idprt-tspl
  • cups-pdf-to-pdf
  • cups-idprt-mt888
  • cups-idprt-mt890
  • cups-idprt-sp900
  • cups-idprt-barcode
  • brgenml1cupswrapper
  • mfc465cncupswrapper
  • cups-brother-dcpt310
  • cups-toshiba-estudio
  • dcp375cw-cupswrapper
  • magicard-cups-driver
  • cups-kyocera-ecosys-m2x35-40-p2x35-40dnw
  • tests.home-assistant-components.apcupsd
  • home-assistant-component-tests.apcupsd
  • cups-brother-hll3230cdw.x86_64-linux
  • home-assistant-component-tests.cups
  • cups-brother-hll2340dw.x86_64-linux
  • cups-brother-hl3140cw.x86_64-linux
  • cups-brother-hl2260d.x86_64-linux
  • cups-brother-hl1210w.x86_64-linux
  • cups-brother-hl1110.x86_64-linux
  • cups-kyocera-ecosys-m552x-p502x
  • mfcj470dwlpr.x86_64-linux
  • python313Packages.pycups
  • cups-brother-dcpl3550cdw
  • cups-brother-dcp1610wlpr
  • perl540Packages.NetCUPS
  • dcp9020cdw-cupswrapper
  • mfcj6510dw-cupswrapper
  • mfcl3770cdwcupswrapper
  • mfcl8690cdwcupswrapper
  • cups-brother-dcpl2550dw
  • cups-brother-mfcl2710dw
  • cups-brother-mfcl2750dw
  • cups-brother-mfcl2800dw
  • perl538Packages.NetCUPS
  • python312Packages.pycups
  • python314Packages.pycups
  • prometheus-apcupsd-exporter
  • gnomeExtensions.apcups-monitor
  • mfc5890cncupswrapper
  • mfcj880dwcupswrapper
  • perlPackages.NetCUPS
  • dcpj785dw-cupswrapper
  • mfc9140cdncupswrapper
  • mfcj470dw-cupswrapper
  • mfcl2700dncupswrapper
  • mfcl2720dwcupswrapper
  • mfcl2740dwcupswrapper
  • perl5Packages.NetCUPS
  • cups-brother-dcpt720dw
  • cups-brother-dcpt725dw
  • cups-brother-hl3170cdw
  • cups-brother-hll2350dw
  • cups-brother-hll2375dw
  • cups-kyocera-3500-4500
  4 months, 2 weeks ago
• @LeSuisse accepted 4 months, 2 weeks ago
• @LeSuisse published on GitHub 4 months, 2 weeks ago

OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users

• https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv x_refsource_CONFIRM
• https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080 x_refsource_MISC

Ignored references (1)

• https://github.com/OpenPrinting/cups/commit/d7fe0f521ff3b24676511e747b058362b9a20737 x_refsource_MISC

---

cups

• ==< 2.4.17

NIXPKGS-2026-1255

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-40517

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names

• https://blog.calif.io/p/mad-bugs-discovering-a-0-day-in-zero technical-descriptionexploit
• https://github.com/radareorg/radare2/issues/25730 issue-tracking
• https://github.com/radareorg/radare2/pull/25731 patch

Ignored references (1)

• https://www.vulncheck.com/advisories/radare2-command-injection-via-pdb-parser-s… third-party-advisory

---

radare2

• <6.1.4