NIXPKGS-2026-1154

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40302

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 4 weeks ago
• @LeSuisse ignored maintainer @bennyandresen 4 months, 4 weeks ago maintainer.ignore
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering

• https://github.com/openziti/zrok/security/advisories/GHSA-4fxq-2x3x-6xqx x_refsource_CONFIRM

Ignored references (1)

• https://github.com/openziti/zrok/releases/tag/v2.0.1 x_refsource_MISC

---

zrok

• ==< 2.0.1

NIXPKGS-2026-1153

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40196

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 4 weeks ago
• @LeSuisse ignored
  2 maintainers

  • @tebriel
  • @PatrickDaG
  4 months, 4 weeks ago maintainer.ignore
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9 x_refsource_CONFIRM
• https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0 x_refsource_MISC

---

homebox

• ==< 0.25.0

NIXPKGS-2026-1152

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40489

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 4 months, 4 weeks ago
• @LeSuisse ignored maintainer @dochang 4 months, 4 weeks ago maintainer.ignore
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

editorconfig-core-c has incomplete fix for CVE-2023-0341

• https://github.com/editorconfig/editorconfig-core-c/security/advisories/GHSA-97xg-vrcq-254h x_refsource_CONFIRM
• https://github.com/editorconfig/editorconfig-core-c/commit/5159be88ad50641d9843289adda791ba300421ff x_refsource_MISC

Ignored references (1)

• https://github.com/editorconfig/editorconfig-core-c/releases/tag/v0.12.11 x_refsource_MISC

---

editorconfig-core-c

• ==< 0.12.11

NIXPKGS-2026-1151

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-41082

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  23 packages

  • dopamine
  • opam2json
  • opam-publish
  • opam-installer
  • ocamlPackages.opam-core
  • ocamlPackages.opam-state
  • ocamlPackages.opam-client
  • ocamlPackages.opam-format
  • ocamlPackages.opam-solver
  • ocamlPackages.opam-repository
  • ocamlPackages.opam-file-format
  • ocamlPackages_latest.opam-core
  • ocamlPackages_latest.opam-state
  • ocamlPackages.opam-0install-cudf
  • ocamlPackages_latest.opam-client
  • ocamlPackages_latest.opam-format
  • ocamlPackages_latest.opam-solver
  • ocamlPackages_latest.opam-repository
  • ocamlPackages_latest.opam-file-format
  • tree-sitter-grammars.tree-sitter-opam
  • ocamlPackages_latest.opam-0install-cudf
  • python313Packages.tree-sitter-grammars.tree-sitter-opam
  • python314Packages.tree-sitter-grammars.tree-sitter-opam
  4 months, 4 weeks ago
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

In OCaml opam before 2.5.1, a .install field containing a …

• https://github.com/ocaml/opam/releases/tag/2.5.1
• https://github.com/ocaml/opam/pull/6897

---

opam

• <2.5.1

NIXPKGS-2026-1149

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40260

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  10 packages

  • capypdf
  • python312Packages.pypdf2
  • python312Packages.pypdf3
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python312Packages.pypdfium2
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  4 months, 4 weeks ago
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-3crg-w4f6-42mx x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3724 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/b15a374e5ca648d4878e57c3b2c0551e7f8cc7f8 x_refsource_MISC

Ignored references (1)

• https://github.com/py-pdf/pypdf/releases/tag/6.10.0 x_refsource_MISC

---

pypdf

• ==< 6.10.0

NIXPKGS-2026-1150

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40253

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c

• https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-c9cf-6vr4-wfxm x_refsource_CONFIRM
• https://github.com/opencryptoki/opencryptoki/commit/ed378f463ef73364c89feb0fc923f4dc867332a3 x_refsource_MISC

---

opencryptoki

• ==<= 3.26.0

NIXPKGS-2026-1148

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40170

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored package ngtcp2-gnutls 4 months, 4 weeks ago
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

ngtcp2 has a qlog transport parameter serialization stack buffer overflow

• https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8f x_refsource_CONFIRM
• https://github.com/ngtcp2/ngtcp2/commit/708a7640c1f48fb8ffb540c4b8ea5b4c1dfb8ee5 x_refsource_MISC

---

ngtcp2

• ==< 1.22.1

NIXPKGS-2026-1147

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40318

8.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vw86-c94w-v3x4 x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 x_refsource_MISC

---

siyuan

• ==< 3.6.4

NIXPKGS-2026-1146

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-41035

7.4 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  19 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python312Packages.sysrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python312Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  4 months, 4 weeks ago
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted …

• https://www.openwall.com/lists/oss-security/2026/04/16/2
• https://github.com/RsyncProject/rsync/issues/871
• http://www.openwall.com/lists/oss-security/2026/04/16/9

Ignored references (1)

• https://github.com/RsyncProject/rsync/releases

---

rsync

• =<3.4.1

NIXPKGS-2026-1145

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40322

9.0 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x63q-3rcj-hhp5 x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 x_refsource_MISC

---

siyuan

• ==< 3.6.4