NIXPKGS-2026-2408

GitHub issue published 1 month ago

python313Packages.python-engineio: security issues < 4.13.2

Permalink CVE-2026-48809

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored
  2 maintainers

  • @dotlambda
  • @Mic92
  1 month ago maintainer.ignore
• @LeSuisse ignored
  2 packages

  • python313Packages.python-engineio-v3
  • python314Packages.python-engineio-v3
  1 month ago
• @LeSuisse published on GitHub 1 month ago

python-engineio has possible denial of service due to maximum payload size sometimes not being enforced

• https://github.com/miguelgrinberg/python-engineio/security/advisories/GHSA-m9gh-vj53-gvh9 x_refsource_CONFIRM
• https://github.com/pypa/advisory-database/tree/main/vulns/python-engineio/PYSEC-2026-3033.yaml x_refsource_MISC

---

python-engineio

• ==< 4.13.2

Permalink CVE-2026-48802

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse ignored
  2 maintainers

  • @dotlambda
  • @Mic92
  1 month ago maintainer.ignore
• @LeSuisse ignored
  2 packages

  • python313Packages.python-engineio-v3
  • python314Packages.python-engineio-v3
  1 month ago
• @LeSuisse published on GitHub 1 month ago

python-engineio has unbound thread allocation that can cause denial of service

• https://github.com/miguelgrinberg/python-engineio/security/advisories/GHSA-cgwc-pv48-fhj5 x_refsource_CONFIRM
• https://github.com/pypa/advisory-database/tree/main/vulns/python-engineio/PYSEC-2026-3032.yaml x_refsource_MISC

---

python-engineio

• ==< 4.13.2

NIXPKGS-2026-2407

GitHub issue published 1 month ago

tesseract: security issues < 5.5.3 (needs backport)

Permalink CVE-2026-73067

6.7 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  6 packages

  • tesseract3
  • tesseract4
  • python313Packages.pytesseract
  • python314Packages.pytesseract
  • perlPackages.ImageOCRTesseract
  • perl5Packages.ImageOCRTesseract
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Tesseract: Heap OOB read in the DAWG loader

• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-x3vq-7rr7-5x3h x_refsource_CONFIRM
• https://github.com/tesseract-ocr/tesseract/issues/4580 x_refsource_MISC
• https://github.com/tesseract-ocr/tesseract/pull/4581 x_refsource_MISC
• https://github.com/tesseract-ocr/tesseract/commit/55287a94b8044c05ce3fd10f5aca6ebbd238e518 x_refsource_MISC
• https://github.com/tesseract-ocr/tesseract/commit/82727cc11c34eaf1249af002d69f6bbae70993b9 x_refsource_MISC
• https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3 x_refsource_MISC

---

tesseract

• ==< 5.5.3

Needs backport

Permalink CVE-2026-73066

6.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  6 packages

  • tesseract3
  • tesseract4
  • python313Packages.pytesseract
  • python314Packages.pytesseract
  • perlPackages.ImageOCRTesseract
  • perl5Packages.ImageOCRTesseract
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata

• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8 x_refsource_CONFIRM
• https://github.com/tesseract-ocr/tesseract/pull/4588 x_refsource_MISC
• https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72 x_refsource_MISC
• https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3 x_refsource_MISC

---

tesseract

• ==< 5.5.3

NIXPKGS-2026-2406

GitHub issue published 1 month ago

freecad: security issues < 1.1.2

Permalink CVE-2026-73235

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser

• https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-cp6c-87x9-xf49 x_refsource_CONFIRM
• https://github.com/FreeCAD/FreeCAD/pull/31271 x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/pull/31280 x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/commit/7d1b8f5806db578db99feb348e55a6b0eaff7c73 x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/commit/d98eaf1f194400d8a8886fe6780c54f5c68ea2c3 x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2 x_refsource_MISC

---

FreeCAD

• ==< 1.1.2

Permalink CVE-2026-73234

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

FreeCAD: FCStd path traversal allows arbitrary file write via unsanitized file attribute in PropertyFileIncluded::Restore()

• https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-5vqh-3v38-jw2r x_refsource_CONFIRM
• https://github.com/FreeCAD/FreeCAD/pull/31269 x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/pull/31281 x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/commit/7cabda0979779251bad516cb6911a43dc03c5203 x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/commit/f19b18b7d93729a29a90e96e0ae192b5d054b86d x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2 x_refsource_MISC

---

FreeCAD

• ==< 1.1.2

Permalink CVE-2026-73233

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

FreeCAD: FEM formula incomplete escape

• https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-2rq3-gx3h-489q x_refsource_CONFIRMexploit
• https://github.com/FreeCAD/FreeCAD/pull/31267 x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/pull/31312 x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/commit/0a208ac11cfe7b61c424ee4bb79117138ec50ac2 x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/commit/3f60d202a8246958232e2fbc74ba38a83483b74e x_refsource_MISC
• https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2 x_refsource_MISC

---

FreeCAD

• ==< 1.1.2

NIXPKGS-2026-2405

GitHub issue published 1 month ago

windmill: security issues < 1.783.0

Permalink CVE-2026-72541

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Windmill Labs Windmill - Missing Authorization

• Project Repository

---

Windmill

• =<1.783.0

Permalink CVE-2026-72542

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Windmill Labs Windmill - Missing Authorization

• Project Repository

---

Windmill

• =<1.783.0

Permalink CVE-2026-72539

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Windmill Labs Windmill - Information Disclosure

• Project Repository

---

Windmill

• =<1.783.0

NIXPKGS-2026-2404

GitHub issue published 1 month ago

calibre: security issues < 9.12.0

Permalink CVE-2026-73249

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  3 packages

  • calibre-web
  • calibre-no-speech
  • pkgsRocm.calibre-no-speech
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification

• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-5x64-w63v-x2g6 x_refsource_CONFIRM
• https://github.com/kovidgoyal/calibre/commit/71295e8b62801e1ccecaa4fac47e6942f11cfe1e x_refsource_MISC
• https://github.com/kovidgoyal/calibre/releases/tag/v9.12.0 x_refsource_MISC

---

calibre

• ==< 9.12.0

Permalink CVE-2026-73248

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  3 packages

  • calibre-web
  • calibre-no-speech
  • pkgsRocm.calibre-no-speech
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

calibre: Bypass of Python template restrictions via nested `template()` leading to RCE

• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-4f7g-rjfp-hmvx x_refsource_CONFIRM
• https://github.com/kovidgoyal/calibre/commit/dac9990458374a81a5372a768bba6527d965aac8 x_refsource_MISC
• https://github.com/kovidgoyal/calibre/releases/tag/v9.12.0 x_refsource_MISC

---

calibre

• ==< 9.12.0

NIXPKGS-2026-2403

GitHub issue published 1 month ago

Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

Permalink CVE-2026-19654

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

• https://access.redhat.com/security/cve/CVE-2026-19654 x_refsource_REDHATvdb-entry
• RHBZ#2502868 x_refsource_REDHATissue-tracking
• https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29

---

rsyslog

rsyslog7

NIXPKGS-2026-2402

GitHub issue published 1 month ago

aws-sdk-cpp: security issues < 1.11.861

Permalink CVE-2026-19642

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp

• https://github.com/aws/aws-sdk-cpp/releases/tag/1.11.862 patchrelease-notes
• https://aws.amazon.com/security/security-bulletins/2026-080-aws/ vendor-advisory
• https://github.com/aws/aws-sdk-cpp/security/advisories/GHSA-wxx3-prfc-69xx release-notes

---

aws-sdk-cpp

• =<1.11.861

Permalink CVE-2026-19643

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms

• https://github.com/aws/aws-sdk-cpp/releases/tag/1.11.862 patchrelease-notes
• https://aws.amazon.com/security/security-bulletins/2026-080-aws/ vendor-advisory
• https://github.com/aws/aws-sdk-cpp/security/advisories/GHSA-mxm9-xpf9-x66x release-notes

---

aws-sdk-cpp

• =<1.11.861

NIXPKGS-2026-2401

GitHub issue published 1 month ago

rubyPackages.loofah: security issues < 2.25.2

Permalink CVE-2026-73491

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

• https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv x_refsource_CONFIRM
• https://github.com/flavorjones/loofah/pull/308 x_refsource_MISC
• https://github.com/flavorjones/loofah/commit/5e91af861e3cdab47b91dd0b81f3afdfd13a5e19 x_refsource_MISC
• https://github.com/flavorjones/loofah/releases/tag/v2.25.2 x_refsource_MISC

---

loofah

• ==>= 2.25.0, < 2.25.2

Permalink CVE-2026-73490

4.7 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Loofah: SVG `href` attribute bypasses local-reference restriction

• https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf x_refsource_CONFIRM
• https://github.com/flavorjones/loofah/pull/308 x_refsource_MISC
• https://github.com/flavorjones/loofah/commit/20867b9be689521887364b74822c41ef830523c9 x_refsource_MISC
• https://github.com/flavorjones/loofah/releases/tag/v2.25.2 x_refsource_MISC

---

loofah

• ==< 2.25.2

Permalink CVE-2026-73492

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

• https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2 x_refsource_CONFIRM
• https://github.com/flavorjones/loofah/pull/308 x_refsource_MISC
• https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0 x_refsource_MISC
• https://github.com/flavorjones/loofah/releases/tag/v2.25.2 x_refsource_MISC

---

loofah

• ==>= 2.25.0, < 2.25.2

NIXPKGS-2026-2400

GitHub issue published 1 month ago

prowler: security issues < 5.36.0 (backport needed)

Permalink CVE-2026-73264

7.6 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider

• https://github.com/prowler-cloud/prowler/security/advisories/GHSA-fhj4-q47f-w7mv x_refsource_CONFIRMexploit
• https://github.com/prowler-cloud/prowler/pull/11928 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/pull/11940 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/commit/1c4d8e3e756ee04367353101af797004d1c0258f x_refsource_MISC
• https://github.com/prowler-cloud/prowler/commit/3f2e5929d9ff3c1a5d2fae49f8edd419ee99a8e2 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/releases/tag/5.33.1 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/releases/tag/5.34.0 x_refsource_MISC

---

prowler

• ==< 5.33.1

Needs backport

Permalink CVE-2026-73263

9.9 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path

• https://github.com/prowler-cloud/prowler/security/advisories/GHSA-ccqh-6cjc-wp4j x_refsource_CONFIRMexploit
• https://github.com/prowler-cloud/prowler/pull/12091 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/commit/0b782fcb8c24ece7bd38deede2b8f13d8583e39c x_refsource_MISC
• https://github.com/prowler-cloud/prowler/releases/tag/5.36.0 x_refsource_MISC

---

prowler

• ==< 5.36.0

Needs backport

NIXPKGS-2026-2399

GitHub issue published 1 month ago

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Permalink CVE-2026-73262

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

• https://github.com/prowler-cloud/prowler/security/advisories/GHSA-c2jg-2778-ggm4 x_refsource_CONFIRM
• https://github.com/prowler-cloud/prowler/pull/12221 x_refsource_MISC
• https://github.com/prowler-cloud/prowler/commit/6db407ed3c17d4c73a8f619fdb30580c8465027f x_refsource_MISC
• https://github.com/prowler-cloud/prowler/releases/tag/5.37.0 x_refsource_MISC

---

prowler

• ==< 5.37.0