NIXPKGS-2026-0979

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-39363

updated 5 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse ignored
  7 packages

  • vite
  • vitess
  • vitetris
  • python312Packages.django-vite
  • python313Packages.django-vite
  • python314Packages.django-vite
  • vscode-extensions.vitest.explorer
  5 months, 1 week ago
• @LeSuisse accepted 5 months, 1 week ago
• @LeSuisse published on GitHub 5 months, 1 week ago

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

• https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583 x_refsource_CONFIRM

---

vite

• ==>= 6.0.0, < 6.4.2
• ==>= 8.0.0, < 8.0.5
• ==>= 7.0.0, < 7.3.2

vite-plus

• ==< 0.1.16

NIXPKGS-2026-0978

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35520

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse ignored
  5 packages

  • swiftlint
  • python312Packages.softlayer
  • python313Packages.softlayer
  • python314Packages.softlayer
  • chickenPackages_5.chickenEggs.ftl
  5 months, 1 week ago
• @LeSuisse accepted 5 months, 1 week ago
• @LeSuisse published on GitHub 5 months, 1 week ago

Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

• https://github.com/pi-hole/FTL/security/advisories/GHSA-fqv2-qhfh-ghcj x_refsource_CONFIRM

---

FTL

• ==>= 6.0, < 6.6

NIXPKGS-2026-0977

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35460

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse accepted 5 months, 1 week ago
• @LeSuisse published on GitHub 5 months, 1 week ago

Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name

• https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4 x_refsource_CONFIRMexploit

---

papra

• ==< 26.4.0

NIXPKGS-2026-0976

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35592

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse ignored
  5 packages

  • python312Packages.pyloadapi
  • python313Packages.pyloadapi
  • python314Packages.pyloadapi
  • home-assistant-component-tests.pyload
  • tests.home-assistant-component-tests.pyload
  5 months, 1 week ago
• @LeSuisse accepted 5 months, 1 week ago
• @LeSuisse published on GitHub 5 months, 1 week ago

pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass

• https://github.com/pyload/pyload/security/advisories/GHSA-mvwx-582f-56r7 x_refsource_CONFIRM

---

pyload

• ==< 0.5.0b3.dev97

NIXPKGS-2026-0975

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35585

updated 5 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse ignored
  4 packages

  • filebrowser-quantum
  • python312Packages.filebrowser-safe
  • python313Packages.filebrowser-safe
  • python314Packages.filebrowser-safe
  5 months, 1 week ago
• @LeSuisse accepted 5 months, 1 week ago
• @LeSuisse published on GitHub 5 months, 1 week ago

File Browser has a Command Injection via Hook Runner

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw x_refsource_CONFIRM
• https://github.com/filebrowser/filebrowser/issues/5199 x_refsource_MISC

---

filebrowser

• ==>= 2.0.0-rc.1, <= 2.63.1

NIXPKGS-2026-0974

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35176

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse accepted 5 months, 1 week ago
• @LeSuisse published on GitHub 5 months, 1 week ago

openFPGALoader has a heap buffer overflow in POFParser::parseSection() via crafted .pof file

• https://github.com/trabucayre/openFPGALoader/security/advisories/GHSA-9x7m-m8gv-px2j x_refsource_CONFIRM

---

openFPGALoader

• ==<= 1.1.1

NIXPKGS-2026-0973

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-34444

updated 5 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse accepted 5 months, 1 week ago
• @LeSuisse published on GitHub 5 months, 1 week ago

Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

• https://github.com/scoder/lupa/security/advisories/GHSA-69v7-xpr6-6gjm x_refsource_CONFIRM

---

lupa

• ==<= 2.6

NIXPKGS-2026-0972

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35471

updated 5 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse accepted 5 months, 1 week ago
• @LeSuisse published on GitHub 5 months, 1 week ago

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs

• https://github.com/patrickhener/goshs/security/advisories/GHSA-6qcc-6q27-whp8 x_refsource_CONFIRM

---

goshs

• ==< 2.0.0-beta.3

NIXPKGS-2026-0971

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35044

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse accepted 5 months, 1 week ago
• @LeSuisse published on GitHub 5 months, 1 week ago

BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation

• https://github.com/bentoml/BentoML/security/advisories/GHSA-v959-cwq9-7hr6 x_refsource_CONFIRM

---

BentoML

• ==< 1.4.38

NIXPKGS-2026-0970

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35170

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse accepted 5 months, 1 week ago
• @LeSuisse published on GitHub 5 months, 1 week ago

openFPGALoader has a heap buffer overflow in BitParser::parseHeader() via crafted .bit file

• https://github.com/trabucayre/openFPGALoader/security/advisories/GHSA-v59x-fvpj-j22x x_refsource_CONFIRM

---

openFPGALoader

• ==<= 1.1.1