NIXPKGS-2026-1722

GitHub issue published 2 weeks, 4 days ago

Permalink CVE-2026-9519

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 2 weeks, 4 days ago by @LeSuisse Activity log

• Created suggestion 2 weeks, 4 days ago
• @LeSuisse ignored reference VDB-36553… 2 weeks, 4 days ago
• @LeSuisse accepted 2 weeks, 4 days ago
• @LeSuisse published on GitHub 2 weeks, 4 days ago

stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting

• VDB-365539 | stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting technical-descriptionvdb-entry
• Submit #814364 | stonith404 pingvin-share 1.13.0 DOM-Based XSS, Open Redirect third-party-advisory
• https://gist.github.com/TrebledJ/0efceef4f3a2e0515cc2fe96b4c22679 exploit

Ignored references (1)

• VDB-365539 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature

---

pingvin-share

• ==1.10
• ==1.13.0
• ==1.5
• ==1.2
• ==1.8
• ==1.0
• ==1.4
• ==1.6
• ==1.12
• ==1.11
• ==1.3
• ==1.9
• ==1.7
• ==1.1

NIXPKGS-2026-1719

GitHub issue published 2 weeks, 4 days ago

Permalink CVE-2026-44832

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 weeks, 4 days ago by @LeSuisse Activity log

• Created suggestion 2 weeks, 4 days ago
• @LeSuisse accepted 2 weeks, 4 days ago
• @LeSuisse published on GitHub 2 weeks, 4 days ago

Snipe-IT: Privilege Escalation via API Permissions Assignment

• https://github.com/grokability/snipe-it/security/advisories/GHSA-hq28-crg7-95pr x_refsource_CONFIRM
• https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569 x_refsource_MISC

---

snipe-it

• ==< 8.4.1

NIXPKGS-2026-1718

GitHub issue published 2 weeks, 4 days ago

Permalink CVE-2026-8647

updated 2 weeks, 4 days ago by @LeSuisse Activity log

• Created suggestion 2 weeks, 4 days ago
• @LeSuisse accepted 2 weeks, 4 days ago
• @LeSuisse published on GitHub 2 weeks, 4 days ago

Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available

• https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/changes release-notes
• https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/diff/MIK/Crypt-ScryptKDF…

---

Crypt-ScryptKDF

• =<0.010

NIXPKGS-2026-1717

GitHub issue published 2 weeks, 4 days ago

Permalink CVE-2026-40033

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 weeks, 4 days ago by @LeSuisse Activity log

• Created suggestion 2 weeks, 4 days ago
• @LeSuisse accepted 2 weeks, 4 days ago
• @LeSuisse published on GitHub 2 weeks, 4 days ago

FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass

• GHSA Advisory GHSA-p6r2-4hgm-m6ff exploitvendor-advisory
• https://github.com/FreeRDP/FreeRDP/commit/23b36cd00ebf0ccd97750fcdbc9aa2f362352da7 patch
• VulnCheck Advisory: FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass third-party-advisory

---

FreeRDP

• ==3.26.0
• <3.26.0

NIXPKGS-2026-1716

GitHub issue published 2 weeks, 4 days ago

Permalink CVE-2026-44314

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 weeks, 4 days ago by @LeSuisse Activity log

• Created suggestion 2 weeks, 4 days ago
• @LeSuisse ignored
  5 packages

  • python312Packages.pytraccar
  • python313Packages.pytraccar
  • python314Packages.pytraccar
  • home-assistant-component-tests.traccar
  • home-assistant-component-tests.traccar_server
  2 weeks, 4 days ago
• @LeSuisse ignored maintainer @frederictobiasc 2 weeks, 4 days ago maintainer.ignore
• @LeSuisse accepted 2 weeks, 4 days ago
• @LeSuisse published on GitHub 2 weeks, 4 days ago

Traccar: Missing edit authorization on device image upload allows read-only users to write files

• https://github.com/traccar/traccar/security/advisories/GHSA-33v4-5x2g-7mjm x_refsource_CONFIRMexploit

---

traccar

• ==< 6.13.0

NIXPKGS-2026-1715

GitHub issue published 2 weeks, 4 days ago

Permalink CVE-2026-42448

3.5 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 weeks, 4 days ago by @LeSuisse Activity log

• Created suggestion 2 weeks, 4 days ago
• @LeSuisse ignored
  8 packages

  • wormhole-rs
  • magic-wormhole-rs
  • python314Packages.magic-wormhole-mailbox-server
  • python313Packages.magic-wormhole-mailbox-server
  • python312Packages.magic-wormhole-mailbox-server
  • python314Packages.magic-wormhole-transit-relay
  • python313Packages.magic-wormhole-transit-relay
  • python312Packages.magic-wormhole-transit-relay
  2 weeks, 4 days ago
• @LeSuisse ignored maintainer @mjoerg 2 weeks, 4 days ago maintainer.ignore
• @LeSuisse accepted 2 weeks, 4 days ago
• @LeSuisse published on GitHub 2 weeks, 4 days ago

wormhole receive, with --output pointing at an existing directory can be path-traversed

• https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-cf92-gfcw-6v53 x_refsource_CONFIRM

---

magic-wormhole

• ==< 0.24.0

NIXPKGS-2026-1714

GitHub issue published 2 weeks, 5 days ago

Permalink CVE-2026-48852

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 weeks, 5 days ago by @LeSuisse Activity log

• Created suggestion 2 weeks, 5 days ago
• @LeSuisse accepted 2 weeks, 5 days ago
• @LeSuisse published on GitHub 2 weeks, 5 days ago

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA …

• https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html
• https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/ecdsa-remotely-trig…

---

PuTTY

• <0.84

NIXPKGS-2026-1713

GitHub issue published 2 weeks, 5 days ago

Permalink CVE-2026-9501

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 2 weeks, 5 days ago by @LeSuisse Activity log

• Created suggestion 2 weeks, 5 days ago
• @LeSuisse ignored
  3 references

  • https://www.gnu.org/
  • VDB-365483 | CTI Indicators (IOB, IOC, …
  • Submit #814250 | LibreDWG Project Libre…
  2 weeks, 5 days ago
• @LeSuisse accepted 2 weeks, 5 days ago
• @LeSuisse published on GitHub 2 weeks, 5 days ago

GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertion

• VDB-365483 | GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertion technical-descriptionvdb-entry
• https://github.com/LibreDWG/libredwg/issues/1242 issue-tracking
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_asse… exploit
• https://github.com/LibreDWG/libredwg/commit/e501cb9926c1e9a07a0d1cc997f3e69e9be… patch

Ignored references (3)

• VDB-365483 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• Submit #814250 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (released 2026-04-10) Reachable Assertion (CWE-617) third-party-advisory
• https://www.gnu.org/ product

---

LibreDWG

• ==0.9
• ==0.10
• ==0.1
• ==0.14
• ==0.13
• ==0.4
• ==0.3
• ==0.11
• ==0.6
• ==0.7
• ==0.5
• ==0.8
• ==0.12
• ==0.2

NIXPKGS-2026-1712

GitHub issue published 2 weeks, 5 days ago

Permalink CVE-2026-9500

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 2 weeks, 5 days ago by @LeSuisse Activity log

• Created suggestion 2 weeks, 5 days ago
• @LeSuisse ignored
  3 references

  • https://www.gnu.org/
  • Submit #814248 | LibreDWG Project Libre…
  • VDB-365482 | CTI Indicators (IOB, IOC, …
  2 weeks, 5 days ago
• @LeSuisse accepted 2 weeks, 5 days ago
• @LeSuisse published on GitHub 2 weeks, 5 days ago

GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow

• VDB-365482 | GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow technical-descriptionvdb-entry
• https://github.com/LibreDWG/libredwg/issues/1241 issue-tracking
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap… exploit

Ignored references (3)

• VDB-365482 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• Submit #814248 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (released 2026-04-10) Heap-based Buffer Overflow (CWE-122) third-party-advisory
• https://www.gnu.org/ product

---

LibreDWG

• ==0.9
• ==0.10
• ==0.1
• ==0.14
• ==0.13
• ==0.4
• ==0.3
• ==0.11
• ==0.6
• ==0.7
• ==0.5
• ==0.8
• ==0.12
• ==0.2

NIXPKGS-2026-1711

GitHub issue published 2 weeks, 5 days ago

Permalink CVE-2026-48850

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 weeks, 5 days ago by @LeSuisse Activity log

• Created suggestion 2 weeks, 5 days ago
• @LeSuisse accepted 2 weeks, 5 days ago
• @LeSuisse published on GitHub 2 weeks, 5 days ago

PuTTY 0.72 before 0.84 has a double free in RSA …

• https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html
• https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/rsakex-double-free.…

---

PuTTY

• <0.84