NIXPKGS-2026-1750

GitHub issue published 2 weeks, 2 days ago

Permalink CVE-2026-45104

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 2 weeks, 2 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 3 days ago
@LeSuisse ignored package minetest-mapserver 2 weeks, 2 days ago
@LeSuisse accepted 2 weeks, 2 days ago
@LeSuisse published on GitHub 2 weeks, 2 days ago

MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`

https://github.com/MapServer/MapServer/security/advisories/GHSA-4h8g-378q-r75m x_refsource_CONFIRM

MapServer

==>= 6.4.0, < 8.6.3

NIXPKGS-2026-1749

GitHub issue published 2 weeks, 2 days ago

Permalink CVE-2026-45137

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 2 weeks, 2 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 3 days ago
@LeSuisse ignored
3 packages
- python312Packages.anchor-kr
- python313Packages.anchor-kr
- python314Packages.anchor-kr
2 weeks, 2 days ago
@LeSuisse ignored maintainer @Denommus 2 weeks, 2 days ago maintainer.ignore
@LeSuisse accepted 2 weeks, 2 days ago
@LeSuisse published on GitHub 2 weeks, 2 days ago

Anchor: Program<'info, System> is not properly validated

https://github.com/otter-sec/anchor/security/advisories/GHSA-c6rc-8jpp-2fgc x_refsource_CONFIRM

anchor

==>= 1.0.0, < 1.0.2

NIXPKGS-2026-1748

GitHub issue published 2 weeks, 2 days ago

Permalink CVE-2026-45090

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 2 weeks, 2 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 3 days ago
@LeSuisse ignored maintainer @fabaff 2 weeks, 2 days ago maintainer.ignore
@LeSuisse accepted 2 weeks, 2 days ago
@LeSuisse published on GitHub 2 weeks, 2 days ago

Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4 x_refsource_CONFIRM
https://github.com/hahwul/dalfox/releases/tag/v2.13.0 x_refsource_MISC

dalfox

==< 2.13.0

NIXPKGS-2026-1747

GitHub issue published 2 weeks, 2 days ago

          Permalink
          
            CVE-2026-45088
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          2 weeks, 2 days ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 weeks, 3 days ago
          
          @LeSuisse
          
              ignored
            
              maintainer @fabaff
            
          2 weeks, 2 days ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          2 weeks, 2 days ago
          
          @LeSuisse
          
              published on GitHub
            
          2 weeks, 2 days ago
          
            Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode
          
      https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2
    
    x_refsource_CONFIRMexploit
  
      https://github.com/hahwul/dalfox/releases/tag/v2.13.0
    
    x_refsource_MISC
  
    dalfox

            ==< 2.13.0

NIXPKGS-2026-1746

GitHub issue published 2 weeks, 2 days ago

Permalink CVE-2026-45089

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 2 weeks, 2 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 3 days ago
@LeSuisse ignored maintainer @fabaff 2 weeks, 2 days ago maintainer.ignore
@LeSuisse accepted 2 weeks, 2 days ago
@LeSuisse published on GitHub 2 weeks, 2 days ago

Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode

https://github.com/hahwul/dalfox/security/advisories/GHSA-8hf9-3q64-q2qf x_refsource_CONFIRM
https://github.com/hahwul/dalfox/releases/tag/v2.13.0 x_refsource_MISC

dalfox

==< 2.13.0

NIXPKGS-2026-1745

GitHub issue published 2 weeks, 2 days ago

Permalink CVE-2026-44838

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 2 weeks, 2 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 3 days ago
@LeSuisse accepted 2 weeks, 2 days ago
@LeSuisse published on GitHub 2 weeks, 2 days ago

RabbitMQ MQTT Topic Permission Authorization Bypass

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x866-xp2g-cx8v x_refsource_CONFIRM

rabbitmq-server

==>= 4.2.0, < 4.2.4

NIXPKGS-2026-1744

GitHub issue published 2 weeks, 2 days ago

Permalink CVE-2026-44378

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 2 weeks, 2 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 3 days ago
@LeSuisse ignored
7 packages
- botanEsdm
- emiluaPlugins.botan
- python312Packages.botan3
- python313Packages.botan3
- python314Packages.botan3
- haskellPackages.botan-low
- haskellPackages.botan-bindings
2 weeks, 2 days ago
@LeSuisse accepted 2 weeks, 2 days ago
@LeSuisse published on GitHub 2 weeks, 2 days ago

Botan: Quadratic complexity decoding BER indefinite length encodings

https://github.com/randombit/botan/security/advisories/GHSA-7q2v-3g27-6g3j x_refsource_CONFIRM

botan

==< 3.12.0

NIXPKGS-2026-1743

GitHub issue published 2 weeks, 2 days ago

Permalink CVE-2026-45087

10.0 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 weeks, 2 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 3 days ago
@LeSuisse accepted 2 weeks, 2 days ago
@LeSuisse published on GitHub 2 weeks, 2 days ago

Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

https://github.com/hahwul/dalfox/security/advisories/GHSA-v25v-m36w-jp4h x_refsource_CONFIRM
https://github.com/hahwul/dalfox/releases/tag/v2.13.0 x_refsource_MISC

dalfox

==< 2.13.0

NIXPKGS-2026-1742

GitHub issue published 2 weeks, 2 days ago

          Permalink
          
            CVE-2026-5296
          
        4.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          2 weeks, 2 days ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 weeks, 3 days ago
          
          @LeSuisse
          
              ignored
            
                45 packages
                gitlab-art
gitlab-duo
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-kas
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl540Packages.AlienBuildPluginDownloadGitLab
terraform-providers.gitlab
rubyPackages.gitlab-markup
ocamlPackages.gitlab-unix
ocamlPackages.gitlab-jsoo
gitlab-container-registry
vimPlugins.gitlab-vim
ocamlPackages.gitlab
gitlab-release-cli
gitlab-ee
gitlab-workhorse
gitlab-ci-ls

          2 weeks, 2 days ago
          
          @LeSuisse
          
              restored
            
              package gitlab-ee
            
          2 weeks, 2 days ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @yayayayaka
@leona-ya
@talyz
@globin
@krav

          2 weeks, 2 days ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          2 weeks, 2 days ago
          
          @LeSuisse
          
              published on GitHub
            
          2 weeks, 2 days ago
          
            Missing Authorization in GitLab
          
      https://gitlab.com/gitlab-org/gitlab/-/work_items/595423
    
      HackerOne Bug Bounty Report #3626303
    
    technical-descriptionpermissions-requiredexploit
  
      https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-releas…
    
    GitLab

            <18.11.4
          
            <19.0.1
          
            <18.10.7

NIXPKGS-2026-1741

GitHub issue published 2 weeks, 2 days ago

          Permalink
          
            CVE-2026-1402
          
        6.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          2 weeks, 2 days ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 weeks, 3 days ago
          
          @LeSuisse
          
              ignored
            
                44 packages
                gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-release-cli
ocamlPackages.gitlab
vimPlugins.gitlab-vim
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl540Packages.AlienBuildPluginDownloadGitLab
gitlab-kas
gitlab-duo
gitlab-art

          2 weeks, 2 days ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @yayayayaka
@leona-ya
@globin
@talyz
@krav

          2 weeks, 2 days ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          2 weeks, 2 days ago
          
          @LeSuisse
          
              published on GitHub
            
          2 weeks, 2 days ago
          
            Allocation of Resources Without Limits or Throttling in GitLab
          
      HackerOne Bug Bounty Report #3517283
    
    technical-descriptionpermissions-requiredexploit
  
      https://gitlab.com/gitlab-org/gitlab/-/work_items/587569
    
      https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-releas…
    
    GitLab

            <18.11.4
          
            <19.0.1
          
            <18.10.7

Nixpkgs security tracker

Published issues

MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`

Anchor: Program<'info, System> is not properly validated

Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode

Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode

RabbitMQ MQTT Topic Permission Authorization Bypass

Botan: Quadratic complexity decoding BER indefinite length encodings

Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

Missing Authorization in GitLab

Allocation of Resources Without Limits or Throttling in GitLab