NIXPKGS-2026-1680

GitHub issue published 3 weeks, 3 days ago

Permalink CVE-2026-42959

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Provider Urgency (U): Red (Red)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 3 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 3 days ago
• @LeSuisse ignored
  15 packages

  • luaPackages.luaunbound
  • lua51Packages.luaunbound
  • lua52Packages.luaunbound
  • lua53Packages.luaunbound
  • lua54Packages.luaunbound
  • lua55Packages.luaunbound
  • luajitPackages.luaunbound
  • prometheus-unbound-exporter
  • python312Packages.pyunbound
  • python313Packages.pyunbound
  • python314Packages.pyunbound
  • haskellPackages.unbound-generics
  • haskellPackages.unbounded-delays
  • haskellPackages.unbound-kind-generics
  • haskellPackages.unbound-generics-unify
  3 weeks, 3 days ago
• @LeSuisse ignored maintainer @Scrumplex 3 weeks, 3 days ago maintainer.ignore
• @LeSuisse accepted 3 weeks, 3 days ago
• @LeSuisse published on GitHub 3 weeks, 3 days ago

Crash during DNSSEC validation of malicious content

• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt vendor-advisory

---

Unbound

• <1.25.1

NIXPKGS-2026-1679

GitHub issue published 3 weeks, 3 days ago

Permalink CVE-2026-44390

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Provider Urgency (U): Amber (Amber)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 3 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 3 days ago
• @LeSuisse ignored
  15 packages

  • haskellPackages.unbound-generics-unify
  • haskellPackages.unbound-kind-generics
  • lua52Packages.luaunbound
  • lua53Packages.luaunbound
  • lua54Packages.luaunbound
  • lua55Packages.luaunbound
  • luajitPackages.luaunbound
  • prometheus-unbound-exporter
  • python312Packages.pyunbound
  • python313Packages.pyunbound
  • python314Packages.pyunbound
  • lua51Packages.luaunbound
  • luaPackages.luaunbound
  • haskellPackages.unbounded-delays
  • haskellPackages.unbound-generics
  3 weeks, 3 days ago
• @LeSuisse ignored maintainer @Scrumplex 3 weeks, 3 days ago maintainer.ignore
• @LeSuisse accepted 3 weeks, 3 days ago
• @LeSuisse published on GitHub 3 weeks, 3 days ago

Unbounded name compression in certain cases causes degradation of service

• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44390.txt vendor-advisory

---

Unbound

• <1.25.1

NIXPKGS-2026-1678

GitHub issue published 3 weeks, 3 days ago

Permalink CVE-2026-42944

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Provider Urgency (U): Red (Red)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 3 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 3 days ago
• @LeSuisse ignored
  15 packages

  • luaPackages.luaunbound
  • lua51Packages.luaunbound
  • lua52Packages.luaunbound
  • lua53Packages.luaunbound
  • lua54Packages.luaunbound
  • lua55Packages.luaunbound
  • luajitPackages.luaunbound
  • prometheus-unbound-exporter
  • python312Packages.pyunbound
  • python313Packages.pyunbound
  • python314Packages.pyunbound
  • haskellPackages.unbound-generics
  • haskellPackages.unbounded-delays
  • haskellPackages.unbound-kind-generics
  • haskellPackages.unbound-generics-unify
  3 weeks, 3 days ago
• @LeSuisse accepted 3 weeks, 3 days ago
• @LeSuisse ignored maintainer @Scrumplex 3 weeks, 3 days ago maintainer.ignore
• @LeSuisse published on GitHub 3 weeks, 3 days ago

Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt vendor-advisory

---

Unbound

• <1.25.1

NIXPKGS-2026-1677

GitHub issue published 3 weeks, 3 days ago

Permalink CVE-2026-43619

7.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 3 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 3 days ago
• @LeSuisse ignored
  19 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python312Packages.sysrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python312Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  3 weeks, 3 days ago
• @LeSuisse ignored reference https://w… 3 weeks, 3 days ago
• @LeSuisse accepted 3 weeks, 3 days ago
• @LeSuisse ignored maintainer @ivan 3 weeks, 3 days ago maintainer.ignore
• @LeSuisse published on GitHub 3 weeks, 3 days ago

Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-4h9m-w5ff-j735 vendor-advisory
• https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 release-notes

Ignored references (1)

• https://www.vulncheck.com/advisories/rsync-symlink-race-condition-via-path-base… third-party-advisory

---

rsync

• <3.4.3

NIXPKGS-2026-1676

GitHub issue published 3 weeks, 3 days ago

Permalink CVE-2026-43618

6.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 3 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 3 days ago
• @LeSuisse ignored
  19 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python312Packages.sysrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python312Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  3 weeks, 3 days ago
• @LeSuisse ignored maintainer @ivan 3 weeks, 3 days ago maintainer.ignore
• @LeSuisse accepted 3 weeks, 3 days ago
• @LeSuisse ignored reference https://w… 3 weeks, 3 days ago
• @LeSuisse published on GitHub 3 weeks, 3 days ago

Rsync < 3.4.3 Integer Overflow Information Disclosure

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq vendor-advisory
• https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 release-notes

Ignored references (1)

• https://www.vulncheck.com/advisories/rsync-integer-overflow-information-disclos… third-party-advisory

---

rsync

• <3.4.3

NIXPKGS-2026-1675

GitHub issue published 3 weeks, 3 days ago

Permalink CVE-2026-45232

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 3 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 3 days ago
• @LeSuisse ignored
  19 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python312Packages.sysrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python312Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  3 weeks, 3 days ago
• @LeSuisse ignored maintainer @ivan 3 weeks, 3 days ago maintainer.ignore
• @LeSuisse accepted 3 weeks, 3 days ago
• @LeSuisse ignored reference https://w… 3 weeks, 3 days ago
• @LeSuisse published on GitHub 3 weeks, 3 days ago

Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-8f85-j2cv-59m8 vendor-advisory
• https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 release-notes

Ignored references (1)

• https://www.vulncheck.com/advisories/rsync-off-by-one-stack-write-via-http-proxy third-party-advisory

---

rsync

• <3.4.3

NIXPKGS-2026-1674

GitHub issue published 3 weeks, 3 days ago

Permalink CVE-2026-43620

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 3 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 3 days ago
• @LeSuisse ignored
  19 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python312Packages.sysrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python312Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  3 weeks, 3 days ago
• @LeSuisse ignored maintainer @ivan 3 weeks, 3 days ago maintainer.ignore
• @LeSuisse accepted 3 weeks, 3 days ago
• @LeSuisse ignored reference https://w… 3 weeks, 3 days ago
• @LeSuisse published on GitHub 3 weeks, 3 days ago

Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files()

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-28pw-r563-rxvm vendor-advisory
• https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 release-notes

Ignored references (1)

• https://www.vulncheck.com/advisories/rsync-out-of-bounds-array-read-via-recv-fi… third-party-advisory

---

rsync

• <3.4.3

NIXPKGS-2026-1673

GitHub issue published 3 weeks, 3 days ago

Permalink CVE-2026-29518

7.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 3 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 3 days ago
• @LeSuisse ignored reference https://w… 3 weeks, 3 days ago
• @LeSuisse ignored
  19 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python312Packages.sysrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python312Packages.vdirsyncer
  • python314Packages.vdirsyncer
  • python313Packages.vdirsyncer
  3 weeks, 3 days ago
• @LeSuisse ignored maintainer @ivan 3 weeks, 3 days ago maintainer.ignore
• @LeSuisse accepted 3 weeks, 3 days ago
• @LeSuisse published on GitHub 3 weeks, 3 days ago

Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

• https://github.com/RsyncProject/rsync/pull/895/changes/8471fdd1561049ef5f58df44… issue-tracking
• https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 release-notes

Ignored references (1)

• https://www.vulncheck.com/advisories/rsync-toctou-race-condition-allows-symlink… third-party-advisory

---

rsync

• <3.4.3

NIXPKGS-2026-1672

GitHub issue published 3 weeks, 3 days ago

Permalink CVE-2026-43617

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 3 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 3 days ago
• @LeSuisse ignored
  19 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python312Packages.sysrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python312Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  3 weeks, 3 days ago
• @LeSuisse ignored maintainer @ivan 3 weeks, 3 days ago maintainer.ignore
• @LeSuisse accepted 3 weeks, 3 days ago
• @LeSuisse ignored reference https://w… 3 weeks, 3 days ago
• @LeSuisse published on GitHub 3 weeks, 3 days ago

Rsync < 3.4.3 Authorization Bypass via Hostname Resolution

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjfm-3w2m-jf4f vendor-advisory
• https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 release-notes

Ignored references (1)

• https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-hostname-re… third-party-advisory

---

rsync

• <3.4.3

NIXPKGS-2026-1671

GitHub issue published 3 weeks, 5 days ago

Permalink CVE-2026-22810

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 5 days ago
• @LeSuisse ignored
  2 packages

  • joplin-cli
  • joplin
  3 weeks, 5 days ago
• @LeSuisse ignored reference https://g… 3 weeks, 5 days ago
• @LeSuisse accepted 3 weeks, 5 days ago
• @LeSuisse published on GitHub 3 weeks, 5 days ago

Joplin: Path traversal in OneNote importer allows overwriting arbitrary files

• https://github.com/laurent22/joplin/security/advisories/GHSA-gcmj-c9gg-9vh6 x_refsource_CONFIRM
• https://github.com/laurent22/joplin/pull/13736 x_refsource_MISC
• https://github.com/laurent22/joplin/commit/791668455e1aae50501ff57ea4783b3fba9d377c x_refsource_MISC
• https://github.com/laurent22/joplin/releases/tag/v3.5.7 x_refsource_MISC

Ignored references (1)

• https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs#L13-L16 x_refsource_MISC

---

joplin

• ==< 3.5.7