NIXPKGS-2026-2328

GitHub issue published 1 month, 1 week ago

VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection

Permalink CVE-2026-54249

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection

• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h7p7-w5gc-xj3w x_refsource_CONFIRM

---

pydantic-ai

• ==>= 1.65.0, < 1.106.0
• ==>= 2.0.0b1, < 2.0.0b6

pydantic-ai-slim

• ==>= 1.65.0, < 1.106.0
• ==>= 2.0.0b1, < 2.0.0b6

NIXPKGS-2026-2327

GitHub issue published 1 month, 1 week ago

perlPackages.DateManip: security issues <= 6.99

Permalink CVE-2026-60075

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time

• https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch patch
• https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.p…
• https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.p…
• http://www.openwall.com/lists/oss-security/2026/07/30/20

---

Date-Manip

• =<6.99

Permalink CVE-2026-60074

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check

• https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60074-r1.patch patch
• https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Base.p…
• https://metacpan.org/release/SBECK/Date-Manip-6.99/source/lib/Date/Manip/Date.p…
• http://www.openwall.com/lists/oss-security/2026/07/30/19

---

Date-Manip

• =<6.99

NIXPKGS-2026-2326

GitHub issue published 1 month, 1 week ago

lib60870: security issues < 2.4.1

Permalink CVE-2026-63033

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

MZ Automation lib60870 Out-of-bounds Read

• https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5…
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

lib60870

• ==2.4.0
• ==2.4.1

Permalink CVE-2026-61893

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

MZ Automation lib60870 Out-of-bounds Read

• https://github.com/mz-automation/lib60870/security/advisories/GHSA-g3w7-x5rx-83…
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

lib60870

• ==2.4.0
• ==2.4.1

NIXPKGS-2026-2325

GitHub issue published 1 month, 1 week ago

SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

Permalink CVE-2026-10031

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored package sftpgo-plugin-auth 1 month, 1 week ago
• @LeSuisse ignored reference Product R… 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

• https://github.com/drakkan/sftpgo/security/advisories/GHSA-fj9v-mxr3-w75w vendor-advisory
• Patch Commit patch
• https://www.vulncheck.com/advisories/sftpgo-permission-bypass-via-symbolic-link… third-party-advisory

Ignored references (1)

• Product Repository product

---

SFTPGo

• <2.7.4

Needs backports to 26.05

NIXPKGS-2026-2324

GitHub issue published 1 month, 1 week ago

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

Permalink CVE-2026-66066

9.5 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse ignored
  10 packages

  • rails-new
  • grails
  • rubyPackages_4_0.rails-html-sanitizer
  • rubyPackages_3_4.rails-html-sanitizer
  • rubyPackages_4_0.rails-dom-testing
  • rubyPackages_3_4.rails-dom-testing
  • rubyPackages_3_3.rails-dom-testing
  • rubyPackages.rails-html-sanitizer
  • rubyPackages.rails-dom-testing
  • rubyPackages_3_3.rails-html-sanitizer
  1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

• https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm x_refsource_CONFIRM
• https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e x_refsource_MISC
• https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5 x_refsource_MISC
• https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a x_refsource_MISC
• https://github.com/rails/rails/releases/tag/v7.2.3.2 x_refsource_MISC
• https://github.com/rails/rails/releases/tag/v8.0.5.1 x_refsource_MISC
• https://github.com/rails/rails/releases/tag/v8.1.3.1 x_refsource_MISC
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml x_refsource_MISC
• https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html x_refsource_MISC
• http://www.openwall.com/lists/oss-security/2026/07/29/9

---

rails

• ==>= 8.0.0.beta1, < 8.0.5.1
• ==>= 8.1.0.beta1, < 8.1.3.1
• ==< 7.2.3.2

NIXPKGS-2026-2323

GitHub issue published 1 month, 1 week ago

libiec61850: security issues < 1.6.2

Permalink CVE-2026-65421

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

MZ Automation libiec61850 Out-of-bounds Read

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

libiec61850

• ==1.6.2
• <1.6.2

Permalink CVE-2026-63550

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

MZ Automation libiec61850 Out-of-bounds Read

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

libiec61850

• ==1.6.2
• <1.6.2

Permalink CVE-2026-66720

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

MZ Automation libiec61850 Out-of-bounds Read

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

libiec61850

• ==1.6.2
• <1.6.2

Permalink CVE-2026-66360

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

MZ Automation libiec61850 Out-of-bounds Read

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

libiec61850

• ==1.6.2
• <1.6.2

Permalink CVE-2026-66369

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

MZ Automation libiec61850 Out-of-bounds Read

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

libiec61850

• ==1.6.2
• <1.6.2

Permalink CVE-2026-56758

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

MZ Automation libiec61850 Out-of-bounds Read

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

libiec61850

• ==1.6.2
• <1.6.2

Permalink CVE-2026-66364

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

MZ Automation libiec61850 Out-of-bounds Read

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

libiec61850

• ==1.6.2
• <1.6.2

Permalink CVE-2026-66349

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

MZ Automation libiec61850 Out-of-bounds Read

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-2…

---

libiec61850

• ==1.6.2
• <1.6.2

NIXPKGS-2026-2322

GitHub issue published 1 month, 1 week ago

goaccess: security issues < 1.11

Permalink CVE-2026-55777

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

GoAccess: Out-of-bounds heap read in parse_ios() via crafted User-Agent leads to remote crash/DoS

• https://github.com/allinurl/goaccess/security/advisories/GHSA-5phr-qpgf-hgrg x_refsource_CONFIRM
• https://github.com/allinurl/goaccess/commit/ba813ed97d998dbdcb8d87e178799a4bb2da9e81 x_refsource_MISC

---

goaccess

• ==< 1.11

Permalink CVE-2026-54715

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

GoAccess: Heap Out-of-Bounds Write in parse_browser()

• https://github.com/allinurl/goaccess/security/advisories/GHSA-qcx5-vh2x-35fr x_refsource_CONFIRM
• https://github.com/allinurl/goaccess/commit/81f90d9dafd6956c188dea9f944d24946d3d3351 x_refsource_MISC

---

goaccess

• ==>= 1.10.2, < 1.11

Permalink CVE-2026-55768

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service

• https://github.com/allinurl/goaccess/security/advisories/GHSA-5gm5-pvh2-wg46 x_refsource_CONFIRM
• https://github.com/allinurl/goaccess/commit/ea74b87254d0adc675c087ff49bddd2d60dc01d5 x_refsource_MISC

---

goaccess

• ==< 1.11

NIXPKGS-2026-2319

GitHub issue published 1 month, 1 week ago

Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`

Permalink CVE-2026-65975

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`

• https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-jpr8-2v3g-wgf9 x_refsource_CONFIRM

---

pydantic-ai

• ==>= 1.88.0, < 1.107.1
• ==>= 2.0.0b1, < 2.5.0

pydantic-ai-slim

• ==>= 1.88.0, < 1.107.1
• ==>= 2.0.0b1, < 2.5.0

NIXPKGS-2026-2321

GitHub issue published 1 month, 1 week ago

Arbitrary Output Location Change in GNU Bison

Permalink CVE-2026-56390

4.6 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored package bisoncpp 1 month, 1 week ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Arbitrary Output Location Change in GNU Bison

• https://cert.pl/en/posts/2026/07/CVE-2026-56389 third-party-advisory
• https://cgit.git.savannah.gnu.org/cgit/bison.git/ patch
• https://cgit.git.savannah.gnu.org/cgit/bison.git/commit/?id=8d101c19d4d9aaedf83… patch

---

Bison

• ==3.8.2

NIXPKGS-2026-2320

GitHub issue published 1 month, 1 week ago

Double-free in the iSNS attribute decoder in open-iscsi

Permalink CVE-2026-55995

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 1 week ago
• @LeSuisse published on GitHub 1 month, 1 week ago

Double-free in the iSNS attribute decoder in open-iscsi

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-55995
• https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144…

---

open-iscsi

• =<56718d4e9d1a4f51c30697b5c0534144bb41c9bb