NIXPKGS-2026-1235

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-41168

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  10 packages

  • capypdf
  • python312Packages.pypdf2
  • python312Packages.pypdf3
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python312Packages.pypdfium2
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

pypdf has possible long runtimes for wrong size values in cross-reference and object streams

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jj6c-8h6c-hppx x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3733 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/62338e9d36419cf193ccec7331784f45df1d70b3 x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.10.1 x_refsource_MISC

---

pypdf

• ==< 6.10.1

NIXPKGS-2026-1233

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-33597

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

PRSD detection denial of service

• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

---

dnsdist

• <1.9.13
• <2.0.4

NIXPKGS-2026-1232

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-33262

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored package rotp 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

Insufficient validation of cookie reply

• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

---

pdns-recursor

• <5.2.9
• <5.4.1
• <5.3.6

NIXPKGS-2026-1231

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-32885

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  5 packages

  • vdrPlugins.softhddevice
  • python312Packages.sounddevice
  • python313Packages.sounddevice
  • python314Packages.sounddevice
  • haskellPackages.gogol-androiddeviceprovisioning
  4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

DDEV has ZipSlip path traversal in tar and zip archive extraction

• https://github.com/ddev/ddev/security/advisories/GHSA-x2xq-qhjf-5mvg x_refsource_CONFIRMexploit

Ignored references (1)

• https://github.com/ddev/ddev/releases/tag/v1.25.2 x_refsource_MISC

---

ddev

• ==< 1.25.2

NIXPKGS-2026-1230

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-33596

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

TCP backend stream ID overflow

• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

---

dnsdist

• <1.9.13
• <2.0.4

NIXPKGS-2026-1229

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-41312

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  10 packages

  • capypdf
  • python312Packages.pypdf2
  • python312Packages.pypdf3
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python312Packages.pypdfium2
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-7gw9-cf7v-778f x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3734 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11 x_refsource_MISC

Ignored references (1)

• https://github.com/py-pdf/pypdf/releases/tag/6.10.2 x_refsource_MISC

---

pypdf

• ==< 6.10.2

NIXPKGS-2026-1228

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-33599

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

Out-of-bounds read in service discovery

• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

---

dnsdist

• <1.9.13
• <2.0.4

NIXPKGS-2026-1227

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-33256

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored package rotp 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

Unbounded memory allocation by internal web server

• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

---

pdns-recursor

• <5.2.9
• <5.4.1
• <5.3.6

NIXPKGS-2026-1226

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-6862

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

Efivar: efivar: denial of service due to stack overflow in device path node parsing

• https://access.redhat.com/security/cve/CVE-2026-6862 x_refsource_REDHATvdb-entry
• RHBZ#2459982 x_refsource_REDHATissue-tracking

---

rhcos

efivar

NIXPKGS-2026-1225

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-41651

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  3 packages

  • gnome-packagekit
  • kdePackages.packagekit-qt
  • qt6Packages.packagekit-qt
  4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

• https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv x_refsource_CONFIRM
• https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html exploitx_refsource_MISC
• http://www.openwall.com/lists/oss-security/2026/04/22/6

Ignored references (3)

• https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L2273-L2277 x_refsource_MISC
• https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L4036 x_refsource_MISC
• https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L873-L882 x_refsource_MISC

---

PackageKit

• ==>= 1.0.2, <= 1.3.4