NIXPKGS-2026-2358

GitHub issue published 1 month, 1 week ago

Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook

Permalink CVE-2026-67623

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook

• Release Notes release-notes
• Researcher Disclosure exploit
• Pull Request (1)
• Pull Request (2)
• Patch Commit patch
• https://www.vulncheck.com/advisories/mistral-vibe-arbitrary-command-execution-v… third-party-advisory

---

mistral-vibe

• <2.23.3

Backport needed

NIXPKGS-2026-2357

GitHub issue published 1 month, 1 week ago

peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Permalink CVE-2026-71281

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

• https://github.com/huggingface/peft
• https://github.com/huggingface/peft/blob/main/src/peft/tuners/lora/corda.py

---

peft

• =<0.19.1

NIXPKGS-2026-2356

GitHub issue published 1 month, 1 week ago

mlflow: Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

Permalink CVE-2026-71211

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  7 packages

  • pkgsRocm.mlflow-server
  • mlflow-server
  • python313Packages.mlflow-tracing
  • pkgsRocm.python3Packages.sagemaker-mlflow
  • python314Packages.sagemaker-mlflow
  • python313Packages.sagemaker-mlflow
  • python314Packages.mlflow-tracing
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

mlflow: Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

• https://github.com/mlflow/mlflow/tree/v3.14.0/mlflow

---

mlflow

• =<3.14.0

Needs some backport to 26.05

NIXPKGS-2026-2355

GitHub issue published 1 month, 1 week ago

memos: security issues < 0.29.1 (backport needed)

Permalink CVE-2026-71272

8.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()

• https://github.com/usememos/memos
• https://github.com/usememos/memos/blob/main/internal/webhook/webhook.go

---

memos

• =<0.29.1

Needs backport

Permalink CVE-2026-71271

8.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

• https://github.com/usememos/memos
• https://github.com/usememos/memos/blob/main/internal/webhook/validate.go

---

memos

• =<0.29.1

NIXPKGS-2026-2354

GitHub issue published 1 month, 1 week ago

livebook: security issues < 0.19.9

Permalink CVE-2026-66297

5.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): High (H)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  3 packages

  • typstPackages.leetcode-livebook
  • typstPackages.leetcode-livebook_0_1_0
  • typstPackages.leetcode-livebook_0_1_1
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Unescaped deployment environment variables in generated setup commands

• https://github.com/livebook-dev/livebook/security/advisories/GHSA-qpjc-w5mm-73mj relatedvendor-advisory
• https://cna.erlef.org/cves/CVE-2026-66297.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-66297 related
• https://github.com/livebook-dev/livebook/commit/b2a8416d149043132fe5a14ed611e0f… patch
• https://github.com/livebook-dev/livebook/commit/0c2487326bbb37cb1eb43bb2f76eb93… patch
• https://github.com/livebook-dev/livebook/commit/f8fe9c62cb8bfc1dd0ccda4ea4a57c5… patch

---

livebook

• <0.19.9
• <0.18.7

livebook-dev/livebook

• <0.19.9-cuda12
• <0.18.7-cuda12
• <0.18.7
• *
• <0.19.9

Permalink CVE-2026-66885

6.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  3 packages

  • typstPackages.leetcode-livebook_0_1_1
  • typstPackages.leetcode-livebook_0_1_0
  • typstPackages.leetcode-livebook
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Livebook Teams identity callback lacks state binding, allowing login CSRF

• https://github.com/livebook-dev/livebook/security/advisories/GHSA-pvvw-28fw-c6fg relatedvendor-advisory
• https://cna.erlef.org/cves/CVE-2026-66885.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-66885 related
• https://github.com/livebook-dev/livebook/commit/21c16168263275541a6e076d0c31852… patch
• https://github.com/livebook-dev/livebook/commit/33a052daa386c4ce08a9c39a07fc90f… patch
• https://github.com/livebook-dev/livebook/commit/6ed2e213e9d5a19a70d7fcad5a8d616… patch

---

livebook

• <0.19.9
• <0.18.7

livebook-dev/livebook

• <0.19.9-cuda12
• <0.18.7-cuda12
• <0.18.7
• *
• <0.19.9

Permalink CVE-2026-68746

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  3 packages

  • typstPackages.leetcode-livebook
  • typstPackages.leetcode-livebook_0_1_0
  • typstPackages.leetcode-livebook_0_1_1
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access

• https://github.com/livebook-dev/livebook/security/advisories/GHSA-74j5-6grg-g6wj relatedvendor-advisory
• https://cna.erlef.org/cves/CVE-2026-68746.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-68746 related
• https://github.com/livebook-dev/livebook/commit/d374e90647edbb00286bfee9182c016… patch
• https://github.com/livebook-dev/livebook/commit/d6d0dfa746b172540442852f74de4a9… patch
• https://github.com/livebook-dev/livebook/commit/2d3a2c710c880abd24a2bc888d3cf52… patch

---

livebook

• <0.19.9

livebook-dev/livebook

• <0.19.9-cuda12
• <0.19.9
• *

Permalink CVE-2026-66881

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  3 packages

  • typstPackages.leetcode-livebook_0_1_1
  • typstPackages.leetcode-livebook_0_1_0
  • typstPackages.leetcode-livebook
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

• https://github.com/livebook-dev/livebook/security/advisories/GHSA-r4h8-2xpq-v48g relatedvendor-advisory
• https://cna.erlef.org/cves/CVE-2026-66881.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-66881 related
• https://github.com/livebook-dev/livebook/commit/1443dd23df6e7b9203b6797f0695a80… patch
• https://github.com/livebook-dev/livebook/commit/acf4cb8c0c79b89c795b180f061be7d… patch
• https://github.com/livebook-dev/livebook/commit/50f86982ebf36c22abeb379b55ec0f2… patch

---

livebook

• <0.19.9
• <0.18.7

livebook-dev/livebook

• <0.19.9-cuda12
• <0.18.7-cuda12
• <0.18.7
• *
• <0.19.9

Permalink CVE-2026-66298

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  3 packages

  • typstPackages.leetcode-livebook_0_1_1
  • typstPackages.leetcode-livebook_0_1_0
  • typstPackages.leetcode-livebook
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

• https://github.com/livebook-dev/livebook/security/advisories/GHSA-68c2-prqg-x62g relatedvendor-advisory
• https://cna.erlef.org/cves/CVE-2026-66298.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-66298 related
• https://github.com/livebook-dev/livebook/commit/296318ffdfa6e5ed7b18ad8d5a5b2af… patch
• https://github.com/livebook-dev/livebook/commit/a552ce8f99ad348ea37061394dc950a… patch
• https://github.com/livebook-dev/livebook/commit/5980e5c6b71036806b3bf54101eb1d6… patch

---

livebook

• <0.19.9
• <0.18.7

livebook-dev/livebook

• <0.19.9-cuda12
• <0.18.7-cuda12
• <0.18.7
• *
• <0.19.9

NIXPKGS-2026-2353

GitHub issue published 1 month, 1 week ago

rclone: security issues < 1.75.0

Permalink CVE-2026-71311

6.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  9 packages

  • librclone
  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  1 month, 1 week ago
• @LeSuisse restored package librclone 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @dotlambda
  • @SuperSandro2000
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

• https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37 x_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.0 x_refsource_MISC

---

rclone

• ==< 1.75.0

Permalink CVE-2026-71310

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  8 packages

  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @SuperSandro2000
  • @dotlambda
  1 month, 1 week ago maintainer.ignore
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

• https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr x_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/21d8cd3b92cd81d987f485051d454ea675d91a2b x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.0 x_refsource_MISC

---

rclone

• ==< 1.75.0

Permalink CVE-2026-71312

8.0 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  8 packages

  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @dotlambda
  • @SuperSandro2000
  1 month, 1 week ago maintainer.ignore
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

• https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2 x_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88 x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.0 x_refsource_MISC

---

rclone

• ==< 1.75.0

Permalink CVE-2026-71309

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  8 packages

  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @dotlambda
  • @SuperSandro2000
  1 month, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 1 month, 1 week ago

rclone: Incomplete path validation allows backend root escape in serve restic

• https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh x_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264 x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.0 x_refsource_MISC

---

rclone

• ==>= 1.40.0, < 1.75.0

Permalink CVE-2026-71313

6.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  8 packages

  • rclone-ui
  • syncrclone
  • rclone-browser
  • plakar-plugin-rclone
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

rclone: Local Encoding Path Traversal

• https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567 x_refsource_CONFIRM
• https://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e x_refsource_MISC
• https://github.com/rclone/rclone/releases/tag/v1.75.0 x_refsource_MISC

---

rclone

• ==>= 1.51.0, < 1.75.0

NIXPKGS-2026-2352

GitHub issue published 1 month, 1 week ago

rancher: security issues < 2.14.4 (change needed for 26.05)

Permalink CVE-2026-59675

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  2 packages

  • terraform-providers.rancher2
  • terraform-providers.rancher_rancher2
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service

• https://github.com/rancher/rancher/security/advisories/GHSA-g4f6-44g4-23xm
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59675

---

Rancher

• <2.12.12
• <2.14.4
• <2.13.8

Permalink CVE-2026-55998

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  2 packages

  • terraform-providers.rancher2
  • terraform-providers.rancher_rancher2
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Cluster Existence Oracle via Unauthenticated Import Endpoint

• https://github.com/rancher/rancher/security/advisories/GHSA-23h9-rr79-r3gh
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55998

---

Rancher

• <2.13.8
• <2.14.4
• <2.12.12
• <2.11.16

Permalink CVE-2026-55997

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  2 packages

  • terraform-providers.rancher2
  • terraform-providers.rancher_rancher2
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Long-lived Rancher registration token exposed in plaintext

• https://github.com/rancher/rancher/security/advisories/GHSA-7r53-jvhg-9jq4
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55997

---

github.com/rancher/rancher

• <2.13.8
• <2.14.4

Permalink CVE-2026-55996

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  2 packages

  • terraform-providers.rancher2
  • terraform-providers.rancher_rancher2
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent

• https://github.com/rancher/rancher/security/advisories/GHSA-9jxv-832x-45q9
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55996

---

Rancher

• <2.13.8
• <2.14.4
• <2.12.12
• <2.11.16

NIXPKGS-2026-2351

GitHub issue published 1 month, 1 week ago

pdm: security issues < 2.27.0 (needs a backport)

Permalink CVE-2026-47764

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  6 packages

  • python313Packages.pdm-pep517
  • python314Packages.pdm-pep517
  • python313Packages.pdm-backend
  • python314Packages.pdm-backend
  • python313Packages.pdm-build-locked
  • python314Packages.pdm-build-locked
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

pdm: Path traversal in wheel installation via overridden write_to_fs

• https://github.com/pdm-project/pdm/security/advisories/GHSA-78v8-vpjp-cjqh x_refsource_CONFIRM
• https://github.com/pdm-project/pdm/releases/tag/2.27.0 x_refsource_MISC

---

pdm

• ==< 2.27.0

Needs a backport

Permalink CVE-2026-47781

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  6 packages

  • python313Packages.pdm-pep517
  • python314Packages.pdm-pep517
  • python313Packages.pdm-backend
  • python314Packages.pdm-backend
  • python313Packages.pdm-build-locked
  • python314Packages.pdm-build-locked
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing

• https://github.com/pdm-project/pdm/security/advisories/GHSA-qq6c-99pv-prvf x_refsource_CONFIRM
• https://github.com/pdm-project/pdm/releases/tag/2.27.0 x_refsource_MISC

---

pdm

• ==< 2.27.0

Needs a backport

Permalink CVE-2026-47763

6.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  6 packages

  • python313Packages.pdm-pep517
  • python314Packages.pdm-pep517
  • python313Packages.pdm-backend
  • python314Packages.pdm-backend
  • python313Packages.pdm-build-locked
  • python314Packages.pdm-build-locked
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

pdm: Project-Local State and Config Writes Follow Symlinks

• https://github.com/pdm-project/pdm/security/advisories/GHSA-ghq2-5c67-fprm x_refsource_CONFIRM
• https://github.com/pdm-project/pdm/releases/tag/2.27.0 x_refsource_MISC

---

pdm

• ==< 2.27.0

Needs a backport

NIXPKGS-2026-2350

GitHub issue published 1 month, 1 week ago

marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

Permalink CVE-2026-67618

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata

• Release Notes release-notes
• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/marimo-api-key-exfiltration-via-malicious-… third-party-advisory

---

marimo

• <0.23.15

NIXPKGS-2026-2349

GitHub issue published 1 month, 1 week ago

Improper input validation vulnerability in Samsung Open Source rlottie allows …

Permalink CVE-2026-18772

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored package libsForQt5.rlottie-qml 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Improper input validation vulnerability in Samsung Open Source rlottie allows …

• https://github.com/Samsung/rlottie/pull/596

---

rlottie

• ==f487eff2f8086b84ae1c7faa0418abec909e874b