NIXPKGS-2026-1094

GitHub issue published 5 months ago

Permalink CVE-2026-4151

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  18 packages

  • zigimports
  • gimpPlugins.gimp
  • gimpPlugins.gmic
  • gimp-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp3-with-plugins
  • gimp2Plugins.fourier
  • gimp2Plugins.farbfeld
  • gimpPlugins.lightning
  • gimp2Plugins.lightning
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.texturize
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability

• ZDI-26-218 x_research-advisory
• vendor-provided URL vendor-advisory

---

GIMP

• ==3.0.8

NIXPKGS-2026-1095

GitHub issue published 5 months ago

Permalink CVE-2026-6192

3.3 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Exploit Code Maturity (E): Proof-of-Concept (P)
• Remediation Level (RL): Official Fix (O)
• Report Confidence (RC): Confirmed (C)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  3 packages

  • python312Packages.pylibjpeg-openjpeg
  • python313Packages.pylibjpeg-openjpeg
  • python314Packages.pylibjpeg-openjpeg
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow

• https://github.com/uclouvain/openjpeg/issues/1619 exploitissue-tracking
• https://github.com/uclouvain/openjpeg/pull/1628 patchissue-tracking
• https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65… patch

Ignored references (4)

• VDB-357114 | uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow technical-descriptionvdb-entry
• VDB-357114 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• Submit #797385 | uclouvain openjpeg 2.5.4 Integer Overflow third-party-advisory
• https://github.com/uclouvain/openjpeg/ product

---

openjpeg

• ==2.5.0
• ==2.5.2
• ==2.5.1
• ==2.5.3
• ==2.5.4

NIXPKGS-2026-1093

GitHub issue published 5 months ago

Permalink CVE-2026-6204

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

LibreNMS versions before 26.3.0 are affected by an authenticated remote …

• https://github.com/librenms/librenms/security/advisories/GHSA-pr3g-phhr-h8fh vendor-advisory
• https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rc… exploit

---

librenms

• <26.3.0

NIXPKGS-2026-1092

GitHub issue published 5 months ago

Permalink CVE-2026-4153

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  18 packages

  • zigimports
  • gimpPlugins.gimp
  • gimpPlugins.gmic
  • gimp-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp3-with-plugins
  • gimp2Plugins.fourier
  • gimp2Plugins.farbfeld
  • gimpPlugins.lightning
  • gimp2Plugins.lightning
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.texturize
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

• ZDI-26-220 x_research-advisory
• vendor-provided URL vendor-advisory

---

GIMP

• ==3.0.8

NIXPKGS-2026-1091

GitHub issue published 5 months ago

Permalink CVE-2026-4154

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  18 packages

  • zigimports
  • gimpPlugins.gimp
  • gimpPlugins.gmic
  • gimp-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp3-with-plugins
  • gimp2Plugins.fourier
  • gimp2Plugins.farbfeld
  • gimpPlugins.lightning
  • gimp2Plugins.lightning
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.texturize
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability

• ZDI-26-221 x_research-advisory
• vendor-provided URL vendor-advisory

---

GIMP

• ==3.0.8

NIXPKGS-2026-1090

GitHub issue published 5 months ago

Permalink CVE-2026-32316

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  38 packages

  • ijq
  • jql
  • jqp
  • njq
  • gojq
  • jqfmt
  • jq-lsp
  • jquake
  • jq-zsh-plugin
  • python312Packages.jq
  • python313Packages.jq
  • python314Packages.jq
  • python312Packages.llm-jq
  • python313Packages.llm-jq
  • python314Packages.llm-jq
  • haskellPackages.js-jquery
  • tests.fetchpatch.relative
  • python312Packages.xstatic-jquery
  • python313Packages.xstatic-jquery
  • python314Packages.xstatic-jquery
  • python312Packages.django-jquery-js
  • python313Packages.django-jquery-js
  • python314Packages.django-jquery-js
  • python312Packages.xstatic-jquery-ui
  • python313Packages.xstatic-jquery-ui
  • python314Packages.xstatic-jquery-ui
  • tree-sitter-grammars.tree-sitter-jq
  • tests.fetchNextcloudApp.simple-sha512
  • vimPlugins.nvim-treesitter-parsers.jq
  • python312Packages.sphinxcontrib-jquery
  • python313Packages.sphinxcontrib-jquery
  • python314Packages.sphinxcontrib-jquery
  • tests.fetchFromGitHub.submodule-leave-git
  • python312Packages.xstatic-jquery-file-upload
  • python313Packages.xstatic-jquery-file-upload
  • python314Packages.xstatic-jquery-file-upload
  • python313Packages.tree-sitter-grammars.tree-sitter-jq
  • python314Packages.tree-sitter-grammars.tree-sitter-jq
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow

• https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f x_refsource_CONFIRM
• https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5 x_refsource_MISC

---

jq

• ==< e47e56d226519635768e6aab2f38f0ab037c09e5

NIXPKGS-2026-1088

GitHub issue published 5 months ago

Permalink CVE-2025-66236

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

• https://github.com/apache/airflow/pull/58662 patch
• https://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/04/13/6

---

apache-airflow

• <3.2.0

NIXPKGS-2026-1089

GitHub issue published 5 months ago

Permalink CVE-2026-5054

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

NoMachine External Control of File Path Local Privilege Escalation Vulnerability

• ZDI-26-248 x_research-advisory

---

NoMachine

• ==9.3.7

https://kb.nomachine.com/SU03X00271

NIXPKGS-2026-1087

GitHub issue published 5 months ago

Permalink CVE-2026-4152

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  18 packages

  • zigimports
  • gimpPlugins.gimp
  • gimpPlugins.gmic
  • gimp-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp3-with-plugins
  • gimp2Plugins.fourier
  • gimp2Plugins.farbfeld
  • gimpPlugins.lightning
  • gimp2Plugins.lightning
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.texturize
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

• ZDI-26-219 x_research-advisory
• vendor-provided URL vendor-advisory

---

GIMP

• ==3.0.8

NIXPKGS-2026-1086

GitHub issue published 5 months ago

Permalink CVE-2026-33948

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  38 packages

  • ijq
  • jql
  • jqp
  • njq
  • gojq
  • jqfmt
  • jq-lsp
  • jquake
  • jq-zsh-plugin
  • python312Packages.jq
  • python313Packages.jq
  • python314Packages.jq
  • python312Packages.llm-jq
  • python313Packages.llm-jq
  • python314Packages.llm-jq
  • haskellPackages.js-jquery
  • tests.fetchpatch.relative
  • python312Packages.xstatic-jquery
  • python313Packages.xstatic-jquery
  • python314Packages.xstatic-jquery
  • python312Packages.django-jquery-js
  • python313Packages.django-jquery-js
  • python314Packages.django-jquery-js
  • python312Packages.xstatic-jquery-ui
  • python313Packages.xstatic-jquery-ui
  • python314Packages.xstatic-jquery-ui
  • tree-sitter-grammars.tree-sitter-jq
  • tests.fetchNextcloudApp.simple-sha512
  • vimPlugins.nvim-treesitter-parsers.jq
  • python312Packages.sphinxcontrib-jquery
  • python313Packages.sphinxcontrib-jquery
  • python314Packages.sphinxcontrib-jquery
  • tests.fetchFromGitHub.submodule-leave-git
  • python312Packages.xstatic-jquery-file-upload
  • python313Packages.xstatic-jquery-file-upload
  • python314Packages.xstatic-jquery-file-upload
  • python313Packages.tree-sitter-grammars.tree-sitter-jq
  • python314Packages.tree-sitter-grammars.tree-sitter-jq
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input

• https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9 x_refsource_CONFIRM
• https://github.com/jqlang/jq/commit/6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b x_refsource_MISC

---

jq

• ==< 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b