NIXPKGS-2026-2378

GitHub issue published 1 month ago

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags

Permalink CVE-2026-19082

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  12 packages

  • perlPackages.ImagerQRCode
  • perl5Packages.ImagerQRCode
  • python313Packages.aliyun-python-sdk-imagerecog
  • python314Packages.aliyun-python-sdk-imagerecog
  • imager
  • usbimager
  • vcdimager
  • rpi-imager
  • gImageReader
  • gimagereader
  • gImageReader-qt
  • gimagereader-qt
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags

• https://github.com/tonycoz/imager/security/advisories/GHSA-hx46-55wp-hv6m exploitvendor-advisory
• https://github.com/tonycoz/imager/commit/24bde0427a113264d53f45a9c29ae756d84c82… patch
• https://metacpan.org/release/TONYC/Imager-1.034/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/08/07/6

---

Imager

• <1.034

NIXPKGS-2026-2377

GitHub issue published 1 month ago

Kakoune has a Critical RCE via Autorestore Backup Filename Injection

Permalink CVE-2026-48120

8.6 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  13 packages

  • kakoune-cr
  • kakoune-lsp
  • kakoune-unwrapped
  • kakounePlugins.kakoune-lsp
  • kakounePlugins.kakoune-buffers
  • kakounePlugins.kakoune-rainbow
  • kakounePlugins.kakoune-registers
  • kakounePlugins.kakoune-catppuccin
  • kakounePlugins.kakoune-easymotion
  • kakounePlugins.kakoune-state-save
  • kakounePlugins.kakoune-buffer-switcher
  • kakounePlugins.kakoune-extra-filetypes
  • kakounePlugins.kakoune-vertical-selection
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Kakoune has a Critical RCE via Autorestore Backup Filename Injection

• https://github.com/mawww/kakoune/security/advisories/GHSA-h99r-h8cp-vwcq x_refsource_CONFIRM
• https://github.com/mawww/kakoune/commit/25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825 x_refsource_MISC

---

kakoune

• ==< 2026.05.21

Backport needed

NIXPKGS-2026-2376

GitHub issue published 1 month ago

Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

Permalink CVE-2026-19079

4.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

• RHSA-2026:51861 x_refsource_REDHATvendor-advisory
• https://access.redhat.com/security/cve/CVE-2026-19079 x_refsource_REDHATvdb-entry
• RHBZ#2511976 x_refsource_REDHATissue-tracking
• https://github.com/SELinuxProject/selinux/commit/a556538c2d5d2583273e025b45c026…

---

rhcos

policycoreutils

policycoreutils-main

• *

NIXPKGS-2026-2375

GitHub issue published 1 month ago

Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

Permalink CVE-2026-61477

2.3 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  14 packages

  • libvirt-dbus
  • libvirt-glib
  • python313Packages.libvirt
  • rubyPackages.ruby-libvirt
  • ocamlPackages.ocaml_libvirt
  • prometheus-libvirt-exporter
  • terraform-providers.libvirt
  • rubyPackages_3_3.ruby-libvirt
  • rubyPackages_3_4.ruby-libvirt
  • rubyPackages_4_0.ruby-libvirt
  • python313Packages.libvirt-python
  • python314Packages.libvirt-python
  • ocamlPackages_latest.ocaml_libvirt
  • terraform-providers.dmacvicar_libvirt
  1 month ago
• @LeSuisse restored package python313Packages.libvirt-python 1 month ago
• @LeSuisse ignored
  2 packages

  • python313Packages.libvirt-python
  • python314Packages.libvirt
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

• https://access.redhat.com/security/cve/CVE-2026-61477 x_refsource_REDHATvdb-entry
• RHBZ#2512066 x_refsource_REDHATissue-tracking
• https://gitlab.com/libvirt/libvirt/-/commit/3cfc77963b512d809348fca07f97fe924fa…

---

libvirt

virt:rhel/libvirt

Fixed in 12.6.0

NIXPKGS-2026-2374

GitHub issue published 1 month ago

lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML

Permalink CVE-2026-48026

8.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML

• https://github.com/treeverse/lakeFS/security/advisories/GHSA-c2r5-5j4w-2xff x_refsource_CONFIRM
• https://github.com/treeverse/lakeFS/blob/77539527e987fb05c27e3e74c59c0a46a05c47a0/webui/src/pages/repositories/repository/fileRenderers/useMarkdownProcessor.tsx x_refsource_MISC

---

lakeFS

• ==< 1.81.1

lakeFS-enterprise

• ==< 1.84.0

Backport needed

NIXPKGS-2026-2373

GitHub issue published 1 month ago

JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

Permalink CVE-2026-54338

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  6 packages

  • python313Packages.jupyterhub-systemdspawner
  • python314Packages.jupyterhub-systemdspawner
  • python313Packages.jupyterhub-tmpauthenticator
  • python314Packages.jupyterhub-tmpauthenticator
  • python313Packages.jupyterhub-ldapauthenticator
  • python314Packages.jupyterhub-ldapauthenticator
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

• https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-p43p-whwx-q52h x_refsource_CONFIRM
• https://github.com/jupyterhub/jupyterhub/commit/d6dc595f84b7509969686da31d87d6d69e7fce0a x_refsource_MISC

---

jupyterhub

• ==< 5.5.0JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.

Backport needed.

NIXPKGS-2026-2372

GitHub issue published 1 month ago

python3Packages.pypdf: security issues < 6.15.0

Permalink CVE-2026-71870

4.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  7 packages

  • capypdf
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

pypdf: Possible large memory usage for large /ToUnicode streams

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3f-mc75-235c x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3944 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.15.0 x_refsource_MISC

---

pypdf

• ==< 6.15.0

Permalink CVE-2026-71852

4.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  7 packages

  • capypdf
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-fwg2-594c-jp42 x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3946 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/51cb6acf9e8a35b77e90b4d87d28fe3e1416d7d7 x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.15.0 x_refsource_MISC

---

pypdf

• ==< 6.15.0

NIXPKGS-2026-2371

GitHub issue published 1 month ago

Mermaid radar diagrams are vulnerable to DoS

Permalink CVE-2026-71439

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  11 packages

  • mdbook-mermaid
  • mermaid-filter
  • python313Packages.sphinxcontrib-mermaid
  • python314Packages.sphinxcontrib-mermaid
  • python313Packages.mkdocs-mermaid2-plugin
  • python314Packages.mkdocs-mermaid2-plugin
  • tree-sitter-grammars.tree-sitter-mermaid
  • vimPlugins.nvim-treesitter-parsers.mermaid
  • vscode-extensions.bierner.markdown-mermaid
  • python313Packages.tree-sitter-grammars.tree-sitter-mermaid
  • python314Packages.tree-sitter-grammars.tree-sitter-mermaid
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Mermaid radar diagrams are vulnerable to DoS

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh x_refsource_CONFIRM
• https://github.com/mermaid-js/mermaid/pull/8022 x_refsource_MISC
• https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e x_refsource_MISC
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 x_refsource_MISC

---

mermaid

• ==>= 11.6.0, < 11.16.1

NIXPKGS-2026-2370

GitHub issue published 1 month ago

Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter

Permalink CVE-2026-63637

8.6 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  3 packages

  • coqPackages.dpdgraph
  • perlPackages.GDGraph
  • perl5Packages.GDGraph
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter

• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-33p8-wc97-5qcj x_refsource_CONFIRM
• https://github.com/dgraph-io/dgraph/commit/aaff09ab9608f87d88e9d601e71d271306083392 x_refsource_MISC

---

dgraph

• ==< 25.3.8

NIXPKGS-2026-2369

GitHub issue published 1 month ago

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Permalink CVE-2026-61632

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-9xwg-3r6f-jcx2 x_refsource_CONFIRM
• https://github.com/facelessuser/pymdown-extensions/releases/tag/11.0 x_refsource_MISC

---

pymdown-extensions

• ==< 11.0