NIXPKGS-2026-0564

GitHub issue published 6 months, 1 week ago

          Permalink
          
            CVE-2026-3606
          
        3.3 LOW
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): Low (L)
        
          Exploit Code Maturity (E): Proof-of-Concept (P)
        
          Remediation Level (RL): Not Defined (X)
        
          Report Confidence (RC): Reasonable (R)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            Ettercap etterfilter ef_output.c add_data_segment out-of-bounds
          
      VDB-349218 | Ettercap etterfilter ef_output.c add_data_segment out-of-bounds
    
    technical-descriptionvdb-entry
  
      VDB-349218 | CTI Indicators (IOB, IOC, IOA)
    
    signaturepermissions-required
  
      Submit #764648 | Ettercap ettercap Ettercap v0.8.4-Garofalo and master-branch Heap-based Buffer Overflow
    
    third-party-advisory
  
      https://github.com/Ettercap/ettercap/issues/1297
    
    issue-tracking
  
      https://github.com/oneafter/0202/blob/main/et/repro
    
    exploit
  
      https://github.com/Ettercap/ettercap/
    
    product
  
    Ettercap

            ==0.8.4-Garofalo
          
            Upstream issue: https://github.com/Ettercap/ettercap/issues/1297

NIXPKGS-2026-0548

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-28681
          
        8.1 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links
          
      https://github.com/irrdnet/irrd/security/advisories/GHSA-22m3-c7vp-49fj
    
    x_refsource_CONFIRM
  
      https://github.com/irrdnet/irrd/commit/8408e0f1b9f47eb2f2e712d6153e32194df05fbb
    
    x_refsource_MISC
  
      https://github.com/irrdnet/irrd/commit/cf62df4a49d3891e80b2879d9b324d1af050000c
    
    x_refsource_MISC
  
      https://irrd.readthedocs.io/en/stable/releases/4.4.5
    
    x_refsource_MISC
  
      https://irrd.readthedocs.io/en/stable/releases/4.5.1
    
    x_refsource_MISC
  
    irrd

            ==>= 4.4.0, < 4.4.5
          
            ==>= 4.5.0, < 4.5.1
          
            https://github.com/irrdnet/irrd/security/advisories/GHSA-22m3-c7vp-49fj
https://github.com/irrdnet/irrd/commit/8408e0f1b9f47eb2f2e712d6153e32194df05fbb
https://github.com/irrdnet/irrd/commit/cf62df4a49d3891e80b2879d9b324d1af050000c
https://irrd.readthedocs.io/en/stable/releases/4.4.5
https://irrd.readthedocs.io/en/stable/releases/4.5.1

NIXPKGS-2026-0529

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-30223
          
        8.8 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes
          
      https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9
    
    x_refsource_CONFIRM
  
      https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233
    
    x_refsource_MISC
  
      https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1
    
    x_refsource_MISC
  
    OliveTin

            ==< 3000.11.1

NIXPKGS-2026-0543

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-29110

2.2 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

Cryptomator: Leaking of cleartext paths into log file in non-debug mode

https://github.com/cryptomator/cryptomator/security/advisories/GHSA-j83j-mwhc-rcgw x_refsource_CONFIRM

cryptomator

==< 1.19.0

NIXPKGS-2026-0554

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-28492
          
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              ignored
            
                4 packages
                filebrowser-quantum
python312Packages.filebrowser-safe
python313Packages.filebrowser-safe
python314Packages.filebrowser-safe

          6 months, 1 week ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory
          
      https://github.com/filebrowser/filebrowser/security/advisories/GHSA-mr74-928f-rw69
    
    x_refsource_CONFIRM
  
      https://github.com/filebrowser/filebrowser/commit/31194fb57a5b92e7155219d7ec7273028fcb2e83
    
    x_refsource_MISC
  
      https://github.com/filebrowser/filebrowser/releases/tag/v2.61.0
    
    x_refsource_MISC
  
    filebrowser

            ==< 2.61.0
          
            https://github.com/filebrowser/filebrowser/security/advisories/GHSA-mr74-928f-rw69
https://github.com/filebrowser/filebrowser/commit/31194fb57a5b92e7155219d7ec7273028fcb2e83

NIXPKGS-2026-0559

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-28790
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login
          
      https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mq
    
    x_refsource_CONFIRM
  
      https://github.com/OliveTin/OliveTin/commit/d9804182eae43cf49f735e6533ddbe1541c2b9a9
    
    x_refsource_MISC
  
      https://github.com/OliveTin/OliveTin/releases/tag/3000.11.0
    
    x_refsource_MISC
  
    OliveTin

            ==< 3000.11.0

NIXPKGS-2026-0534

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-28683

8.7 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

Gokapi: Stored XSS in SVG Hotlinks

https://github.com/Forceu/Gokapi/security/advisories/GHSA-3c22-5j5m-4jq7 x_refsource_CONFIRM
https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC

Gokapi

==< 2.2.3

NIXPKGS-2026-0561

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-28277

6.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Adjacent (A)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Adjacent (A)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt ignored
28 packages
- langgraph-cli
- python312Packages.langgraph-cli
- python312Packages.langgraph-sdk
- python313Packages.langgraph-cli
- python313Packages.langgraph-sdk
- python314Packages.langgraph-cli
- python314Packages.langgraph-sdk
- python312Packages.langgraph-prebuilt
- python313Packages.langgraph-prebuilt
- python314Packages.langgraph-prebuilt
- python312Packages.langgraph-checkpoint
- python313Packages.langgraph-checkpoint
- python314Packages.langgraph-checkpoint
- python312Packages.langgraph-runtime-inmem
- python312Packages.langgraph-store-mongodb
- python313Packages.langgraph-runtime-inmem
- python313Packages.langgraph-store-mongodb
- python314Packages.langgraph-runtime-inmem
- python314Packages.langgraph-store-mongodb
- python312Packages.langgraph-checkpoint-sqlite
- python313Packages.langgraph-checkpoint-sqlite
- python314Packages.langgraph-checkpoint-sqlite
- python312Packages.langgraph-checkpoint-mongodb
- python313Packages.langgraph-checkpoint-mongodb
- python314Packages.langgraph-checkpoint-mongodb
- python312Packages.langgraph-checkpoint-postgres
- python313Packages.langgraph-checkpoint-postgres
- python314Packages.langgraph-checkpoint-postgres
6 months, 1 week ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading

https://github.com/langchain-ai/langgraph/security/advisories/GHSA-g48c-2wqr-h844 x_refsource_CONFIRM

langgraph

==<= 1.0.9

https://github.com/langchain-ai/langgraph/security/advisories/GHSA-g48c-2wqr-h844

NIXPKGS-2026-0556

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-28789

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling

https://github.com/OliveTin/OliveTin/security/advisories/GHSA-45m3-398w-m2m9 x_refsource_CONFIRM
https://github.com/OliveTin/OliveTin/commit/f044d90d5525c4c8e3f421b32ed7eff771c22d36 x_refsource_MISC

OliveTin

==< 3000.10.3

NIXPKGS-2026-0530

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-26017

7.7 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

CoreDNS ACL Bypass

https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr x_refsource_CONFIRM
https://github.com/coredns/coredns/releases/tag/v1.14.2 x_refsource_MISC

coredns

==< 1.14.2

Nixpkgs security tracker

Published issues

Ettercap etterfilter ef_output.c add_data_segment out-of-bounds

IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links

OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes

Cryptomator: Leaking of cleartext paths into log file in non-debug mode

File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory

OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

Gokapi: Stored XSS in SVG Hotlinks

LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading

OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling

CoreDNS ACL Bypass