NIXPKGS-2026-2436

GitHub issue published 6 days, 20 hours ago

limesurvey: security issues <= 7.0.5

          Permalink
          
            CVE-2026-18403
          
        6.0 MEDIUM
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): Present (P)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): High (H)
        
          Vulnerable System Impact Integrity (VI): Low (L)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): Present (P)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): High (H)
        
          Modified Vulnerable System Impact Integrity (MVI): Low (L)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          6 days, 20 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week ago
          
          @LeSuisse
          
              ignored
            
              reference https://g…
            
          6 days, 20 hours ago
          
          @LeSuisse
          
              accepted
            
          6 days, 20 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          6 days, 20 hours ago
          
            LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB
          
      https://fluidattacks.com/es/advisories/rihanna
    
    third-party-advisoryexploit
  
      https://github.com/LimeSurvey/LimeSurvey/commit/7735ce31cea1cad087b0c8556cb65a1…
    
    patch
  
          Ignored references (1)
        
      https://github.com/LimeSurvey/LimeSurvey/
    
    product
  
    LimeSurvey

            ==7.0.5

          Permalink
          
            CVE-2026-63361
          
        8.5 HIGH
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Active (A)
        
          Vulnerable System Impact Confidentiality (VC): High (H)
        
          Vulnerable System Impact Integrity (VI): High (H)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): Low (L)
        
          Subsequent System Impact Integrity (SI): Low (L)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Active (A)
        
          Modified Vulnerable System Impact Confidentiality (MVC): High (H)
        
          Modified Vulnerable System Impact Integrity (MVI): High (H)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Low (L)
        
          Modified Subsequent System Impact Integrity (MSI): Low (L)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          6 days, 20 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week ago
          
          @LeSuisse
          
              ignored
            
              reference https://g…
            
          6 days, 20 hours ago
          
          @LeSuisse
          
              accepted
            
          6 days, 20 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          6 days, 20 hours ago
          
            LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup
          
      https://fluidattacks.com/es/advisories/mercedes
    
    third-party-advisoryexploit
  
      https://github.com/LimeSurvey/LimeSurvey/commit/a8993bfd05c4a11255b8400ed9c41a2…
    
    patch
  
          Ignored references (1)
        
      https://github.com/LimeSurvey/LimeSurvey
    
    product
  
    LimeSurvey

            ==7.0.5

NIXPKGS-2026-2435

GitHub issue published 6 days, 21 hours ago

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Permalink CVE-2026-48702

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 days, 21 hours ago by @LeSuisse Activity log

Created suggestion 1 week, 1 day ago
@LeSuisse ignored
3 packages
- python313Packages.sigstore-rekor-types
- python314Packages.sigstore-rekor-types
- rekor-cli
6 days, 21 hours ago
@LeSuisse accepted 6 days, 21 hours ago
@LeSuisse published on GitHub 6 days, 21 hours ago

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m x_refsource_CONFIRM

rekor

==>= 0.3.0, < 1.5.2

Needs backport

NIXPKGS-2026-2434

GitHub issue published 6 days, 21 hours ago

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

          Permalink
          
            CVE-2026-49478
          
        8.7 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 days, 21 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 1 day ago
          
          @LeSuisse
          
              accepted
            
          6 days, 21 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          6 days, 21 hours ago
          
            Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
          
      https://github.com/sigstore/fulcio/security/advisories/GHSA-f5mr-q85p-6hh6
    
    x_refsource_CONFIRM
  
      https://github.com/sigstore/fulcio/pull/2354
    
    x_refsource_MISC
  
      https://github.com/sigstore/fulcio/commit/378c654f48c3bafdced04ead7010aab2cb4c6ca1
    
    x_refsource_MISC
  
      https://github.com/sigstore/fulcio/releases/tag/v1.8.6
    
    x_refsource_MISC
  
    fulcio

            ==< 1.8.6
          
            Needs backport

NIXPKGS-2026-2433

GitHub issue published 1 week, 2 days ago

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

          Permalink
          
            CVE-2026-73501
          
        9.1 CRITICAL
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 week, 2 days ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 2 days ago
          
          @LeSuisse
          
              accepted
            
          1 week, 2 days ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 2 days ago
          
            kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
          
      https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw
    
    x_refsource_CONFIRM
  
      https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da
    
    x_refsource_MISC
  
      https://github.com/getkin/kin-openapi/releases/tag/v0.144.0
    
    x_refsource_MISC
  
    kin-openapi

            ==< 0.144.0

NIXPKGS-2026-2432

GitHub issue published 1 week, 2 days ago

Incorrect Privilege Assignment in GitLab

          Permalink
          
            CVE-2025-9486
          
        3.3 LOW
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): High (H)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): High (H)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 week, 2 days ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 2 days ago
          
          @LeSuisse
          
              ignored
            
                40 packages
                gitlab-art
gitlab-duo
gitlab-kas
gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-ci-validate
gitlab-release-cli
ocamlPackages.gitlab
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab

          1 week, 2 days ago
          
          @LeSuisse
          
              accepted
            
          1 week, 2 days ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 2 days ago
          
            Incorrect Privilege Assignment in GitLab
          
      GitLab Issue #565412
    
    issue-trackingpermissions-required
  
      HackerOne Bug Bounty Report #3262844
    
    exploittechnical-descriptionpermissions-required
  
      https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-2-released/
    
    GitLab

            <19.1.4
          
            <19.2.2
          
            <19.0.6

NIXPKGS-2026-2431

GitHub issue published 1 week, 2 days ago

Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source …

Permalink CVE-2026-19588

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 1 week, 2 days ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse ignored package libsForQt5.rlottie-qml 1 week, 2 days ago
@LeSuisse accepted 1 week, 2 days ago
@LeSuisse published on GitHub 1 week, 2 days ago

Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source …

https://github.com/Samsung/rlottie/pull/600

rlottie

==8117b9ee595763f35c0da2c07181203959f0c510

NIXPKGS-2026-2430

GitHub issue published 1 week, 2 days ago

regclient may leak authentication credentials to external blob stores

Permalink CVE-2026-49349

6.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 1 week, 2 days ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse ignored
3 packages
- regsync
- regctl
- regbot
1 week, 2 days ago
@LeSuisse accepted 1 week, 2 days ago
@LeSuisse published on GitHub 1 week, 2 days ago

regclient may leak authentication credentials to external blob stores

https://github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp x_refsource_CONFIRM

regclient

==< 0.11.5

Needs backport

NIXPKGS-2026-2429

GitHub issue published 1 week, 2 days ago

tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

          Permalink
          
            CVE-2026-9318
          
        4.8 MEDIUM
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Active (A)
        
          Vulnerable System Impact Confidentiality (VC): Low (L)
        
          Vulnerable System Impact Integrity (VI): Low (L)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): Low (L)
        
          Subsequent System Impact Integrity (SI): Low (L)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Active (A)
        
          Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
        
          Modified Vulnerable System Impact Integrity (MVI): Low (L)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Low (L)
        
          Modified Subsequent System Impact Integrity (MSI): Low (L)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          1 week, 2 days ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 2 days ago
          
          @LeSuisse
          
              accepted
            
          1 week, 2 days ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 2 days ago
          
            tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title
          
      Product Repository
    
    product
  
      Pull Request
    
    issue-tracking
  
      Patch Release
    
    patch
  
      https://www.vulncheck.com/advisories/tablib-versions-prior-to-stored-xss-via-ht…
    
    third-party-advisory
  
    tablib

            <3.10.0

NIXPKGS-2026-2428

GitHub issue published 1 week, 2 days ago

RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

          Permalink
          
            CVE-2026-73288
          
        6.1 MEDIUM
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Attack Requirement (AT): Present (P)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): High (H)
        
          Vulnerable System Impact Availability (VA): High (H)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Attack Requirement (MAT): Present (P)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): High (H)
        
          Modified Vulnerable System Impact Availability (MVA): High (H)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          1 week, 2 days ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 2 days ago
          
          @LeSuisse
          
              accepted
            
          1 week, 2 days ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 2 days ago
          
            RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted
          
      https://github.com/rustfs/rustfs/security/advisories/GHSA-j548-9grx-fh4f
    
    x_refsource_CONFIRM
  
      https://github.com/rustfs/rustfs/pull/5648
    
    x_refsource_MISC
  
      https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d
    
    x_refsource_MISC
  
      https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1
    
    x_refsource_MISC
  
    rustfs

            ==< 1.0.0-rc.1

NIXPKGS-2026-2427

GitHub issue published 1 week, 2 days ago

Material for MkDocs: DOM XSS in search suggestions via query parameter

          Permalink
          
            CVE-2026-73295
          
        5.4 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 week, 2 days ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 2 days ago
          
          @LeSuisse
          
              ignored
            
                2 packages
                python313Packages.mkdocs-material-extensions
python314Packages.mkdocs-material-extensions

          1 week, 2 days ago
          
          @LeSuisse
          
              accepted
            
          1 week, 2 days ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 2 days ago
          
            Material for MkDocs: DOM XSS in search suggestions via query parameter
          
      https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf
    
    x_refsource_CONFIRM
  
      https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25
    
    x_refsource_MISC
  
      https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7
    
    x_refsource_MISC
  
    mkdocs-material

            ==>= 7.2.0, < 9.7.7

Nixpkgs security tracker

Published issues

LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB

LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Incorrect Privilege Assignment in GitLab

Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source …

regclient may leak authentication credentials to external blob stores

tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

Material for MkDocs: DOM XSS in search suggestions via query parameter