NIXPKGS-2026-1213

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-40594

4.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  5 packages

  • python312Packages.pyloadapi
  • python313Packages.pyloadapi
  • python314Packages.pyloadapi
  • home-assistant-component-tests.pyload
  • tests.home-assistant-components.pyload
  4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

• https://github.com/pyload/pyload/security/advisories/GHSA-mp82-fmj6-f22v x_refsource_CONFIRMexploit

---

pyload

• ==< 0.5.0b3.dev98

NIXPKGS-2026-1211

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-39378

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

• https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9 x_refsource_CONFIRM

Ignored references (1)

• https://github.com/jupyter/nbconvert/releases/tag/v7.17.1 x_refsource_MISC

---

nbconvert

• ==>= 6.5, < 7.17.1

NIXPKGS-2026-1216

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-41133

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  5 packages

  • python312Packages.pyloadapi
  • python313Packages.pyloadapi
  • python314Packages.pyloadapi
  • home-assistant-component-tests.pyload
  • tests.home-assistant-components.pyload
  4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

• https://github.com/pyload/pyload/security/advisories/GHSA-66hx-chf7-3332 x_refsource_CONFIRM
• https://github.com/pyload/pyload/commit/e95804fb0d06cbb07d2ba380fc494d9ff89b68c1 x_refsource_MISC

---

pyload

• ==<= 0.5.0b3.dev97

NIXPKGS-2026-1210

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-5789

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

Search path without quotes in CivetWeb

• https://www.incibe.es/en/incibe-cert/notices/aviso/search-path-without-quotes-c… patch

---

CivetWeb

• ==1.16

NIXPKGS-2026-1215

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-39388

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

• https://github.com/openbao/openbao/security/advisories/GHSA-7ccv-rp6m-rffr x_refsource_CONFIRM

---

openbao

• ==< 2.5.3

NIXPKGS-2026-1209

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-41527

6.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

KDE Kleopatra before 26.08.0 on Windows allows local users to …

• https://commits.kde.org/kleopatra/73471abb92d99c56354adb582bfaec2764c22b79
• https://kde.org/info/security/advisory-20260408-1.txt

Ignored references (1)

• https://github.com/KDE/kleopatra/releases

---

Kleopatra

• <26.08.0

NIXPKGS-2026-1208

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-40279

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()`

• https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-326g-j95f-gmxv exploitx_refsource_CONFIRM

---

bacnet-stack

• ==< 1.4.3

NIXPKGS-2026-1207

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-41131

5.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  4 packages

  • openfga-cli
  • python312Packages.openfga-sdk
  • python313Packages.openfga-sdk
  • python314Packages.openfga-sdk
  4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

OpenFGA has Improper Policy Enforcement

• https://github.com/openfga/openfga/security/advisories/GHSA-57j5-qwp2-vqp6 x_refsource_CONFIRM

Ignored references (1)

• https://github.com/openfga/openfga/releases/tag/v1.14.1 x_refsource_MISC

---

openfga

• ==< 1.14.1

NIXPKGS-2026-1204

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-5358

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  28 packages

  • libc
  • iconv
  • getent
  • locale
  • mtrace
  • getconf
  • libiconv
  • glibcInfo
  • glibc_multi
  • glibcLocales
  • glibc_memusage
  • glibcLocalesUtf8
  • unixtools.getent
  • unixtools.locale
  • unixtools.getconf
  • minimal-bootstrap.glibc
  • tests.hardeningFlags.glibcxxassertionsStdenvUnsupp
  • tests.hardeningFlags.glibcxxassertionsExplicitEnabled
  • tests.hardeningFlags-gcc.glibcxxassertionsStdenvUnsupp
  • tests.hardeningFlags.glibcxxassertionsExplicitDisabled
  • tests.hardeningFlags-clang.glibcxxassertionsStdenvUnsupp
  • tests.hardeningFlags-gcc.glibcxxassertionsExplicitEnabled
  • tests.hardeningFlags.allExplicitDisabledGlibcxxAssertions
  • tests.hardeningFlags-gcc.glibcxxassertionsExplicitDisabled
  • tests.hardeningFlags-clang.glibcxxassertionsExplicitEnabled
  • tests.hardeningFlags-clang.glibcxxassertionsExplicitDisabled
  • tests.hardeningFlags-gcc.allExplicitDisabledGlibcxxAssertions
  • tests.hardeningFlags-clang.allExplicitDisabledGlibcxxAssertions
  4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

Static buffer overflow in deprecated nis_local_principal

• https://sourceware.org/bugzilla/show_bug.cgi?id=34067

---

glibc

• =<2.43

https://www.openwall.com/lists/oss-security/2026/04/20/9

NIXPKGS-2026-1203

GitHub issue published 4 months, 3 weeks ago

Permalink CVE-2026-5928

updated 4 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 3 weeks ago
• @LeSuisse ignored
  28 packages

  • libc
  • iconv
  • locale
  • mtrace
  • getconf
  • libiconv
  • glibcInfo
  • glibc_multi
  • glibcLocales
  • glibc_memusage
  • glibcLocalesUtf8
  • unixtools.getent
  • unixtools.locale
  • unixtools.getconf
  • minimal-bootstrap.glibc
  • tests.hardeningFlags.glibcxxassertionsStdenvUnsupp
  • tests.hardeningFlags.glibcxxassertionsExplicitEnabled
  • tests.hardeningFlags-gcc.glibcxxassertionsStdenvUnsupp
  • tests.hardeningFlags.glibcxxassertionsExplicitDisabled
  • tests.hardeningFlags-clang.glibcxxassertionsStdenvUnsupp
  • tests.hardeningFlags-gcc.glibcxxassertionsExplicitEnabled
  • tests.hardeningFlags.allExplicitDisabledGlibcxxAssertions
  • tests.hardeningFlags-gcc.glibcxxassertionsExplicitDisabled
  • tests.hardeningFlags-clang.glibcxxassertionsExplicitEnabled
  • tests.hardeningFlags-clang.glibcxxassertionsExplicitDisabled
  • tests.hardeningFlags-gcc.allExplicitDisabledGlibcxxAssertions
  • tests.hardeningFlags-clang.allExplicitDisabledGlibcxxAssertions
  • getent
  4 months, 3 weeks ago
• @LeSuisse accepted 4 months, 3 weeks ago
• @LeSuisse published on GitHub 4 months, 3 weeks ago

Static buffer overflow in deprecated nis_local_principal

• https://sourceware.org/bugzilla/show_bug.cgi?id=33998

---

glibc

• =<2.43

https://www.openwall.com/lists/oss-security/2026/04/20/9