NIXPKGS-2026-2068

GitHub issue published 3 weeks, 3 days ago

myVesta is affected by an authenticated remote code execution vulnerability. …

Permalink CVE-2026-12195

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 3 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 3 days ago
• @LeSuisse ignored package vesta-viewer 3 weeks, 3 days ago
• @LeSuisse accepted 3 weeks, 3 days ago
• @LeSuisse published on GitHub 3 weeks, 3 days ago

myVesta is affected by an authenticated remote code execution vulnerability. …

• https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422 patch
• https://projectblack.io/blog/local-ai-for-cyber-security/#myvesta-authenticated… exploit

---

vesta

• <95d7e43bf286d6881ca753dac93cb42d98cc7422

NIXPKGS-2026-2067

GitHub issue published 3 weeks, 4 days ago

Hplip: incomplete fix for cve-2026-8631

Permalink CVE-2026-14544

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 weeks, 4 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 4 days ago
• @LeSuisse ignored package gnomeExtensions.alternate-menu-for-hplip2 3 weeks, 4 days ago
• @LeSuisse accepted 3 weeks, 4 days ago
• @LeSuisse published on GitHub 3 weeks, 4 days ago

Hplip: incomplete fix for cve-2026-8631

• https://access.redhat.com/security/cve/CVE-2026-14544 vdb-entryx_refsource_REDHAT
• RHBZ#2496772 issue-trackingx_refsource_REDHAT

---

hplip

NIXPKGS-2026-2066

GitHub issue published 3 weeks, 4 days ago

Gimp: gimp: heap buffer overflow in read_channel_data()

Permalink CVE-2026-58379

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 weeks, 4 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 4 days ago
• @LeSuisse ignored
  19 packages

  • gimp2
  • gimp-with-plugins
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.lightning
  • gimp2Plugins.texturize
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  • gimp2Plugins.farbfeld
  • gimp3-with-plugins
  • gimpPlugins.lightning
  • gimp2Plugins.fourier
  • gimpPlugins.gmic
  • gimpPlugins.gimp
  • zigimports
  3 weeks, 4 days ago
• @LeSuisse accepted 3 weeks, 4 days ago
• @LeSuisse published on GitHub 3 weeks, 4 days ago

Gimp: gimp: heap buffer overflow in read_channel_data()

• https://access.redhat.com/security/cve/CVE-2026-58379 vdb-entryx_refsource_REDHAT
• RHBZ#2495997 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/gimp/-/commit/b630f167
• https://gitlab.gnome.org/GNOME/gimp/-/issues/16205

---

gimp

gimp:2.8/gimp

NIXPKGS-2026-2065

GitHub issue published 3 weeks, 4 days ago

assimp: security issues < 6.0.4

Permalink CVE-2026-14610

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 weeks, 4 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 4 days ago
• @LeSuisse ignored
  3 references

  • VDB-376118 | CTI Indicators (IOB, IOC, …
  • CVE-2026-14610 | CVE Analysis and Report
  • Submit #844646 | Assimp commit 17c12da …
  3 weeks, 4 days ago
• @LeSuisse accepted 3 weeks, 4 days ago
• @LeSuisse published on GitHub 3 weeks, 4 days ago

Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow

• VDB-376118 | Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow vdb-entrytechnical-description
• https://github.com/assimp/assimp/issues/6622 issue-tracking
• https://github.com/assimp/assimp/pull/6649 patchissue-tracking
• https://github.com/user-attachments/files/27235863/poc.zip exploit
• https://github.com/assimp/assimp/commit/eb84eec580d3f4ba2f0fd87409b7d0744620f11e patch

Ignored references (3)

• VDB-376118 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-14610 | CVE Analysis and Report third-party-advisory
• Submit #844646 | Assimp commit 17c12da Heap-based Buffer Overflow third-party-advisory

---

Assimp

• ==6.0.4
• ==6.0.1
• ==6.0.2
• ==6.0.0
• ==6.0.3
• ==6.0.5

Permalink CVE-2026-14604

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 weeks, 4 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 4 days ago
• @LeSuisse ignored
  3 references

  • VDB-376112 | CTI Indicators (IOB, IOC, …
  • CVE-2026-14604 | CVE Analysis and Report
  • Submit #844567 | Assimp commit 17c12da …
  3 weeks, 4 days ago
• @LeSuisse accepted 3 weeks, 4 days ago
• @LeSuisse published on GitHub 3 weeks, 4 days ago

Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free

• VDB-376112 | Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free vdb-entrytechnical-description
• https://github.com/assimp/assimp/issues/6620 issue-tracking
• https://github.com/user-attachments/files/27232640/poc.zip exploit

Ignored references (3)

• VDB-376112 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-14604 | CVE Analysis and Report third-party-advisory
• Submit #844567 | Assimp commit 17c12da Double Free third-party-advisory

---

Assimp

• ==6.0.4
• ==6.0.1
• ==6.0.2
• ==6.0.0
• ==6.0.3

NIXPKGS-2026-2064

GitHub issue published 3 weeks, 5 days ago

Gimp: gimp: double-free in read_layer_block()

Permalink CVE-2026-58381

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 5 days ago
• @LeSuisse ignored
  19 packages

  • gimp2
  • zigimports
  • gimpPlugins.gimp
  • gimpPlugins.gmic
  • gimp-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp3-with-plugins
  • gimp2Plugins.fourier
  • gimp2Plugins.farbfeld
  • gimpPlugins.lightning
  • gimp2Plugins.lightning
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.texturize
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  3 weeks, 5 days ago
• @LeSuisse accepted 3 weeks, 5 days ago
• @LeSuisse published on GitHub 3 weeks, 5 days ago

Gimp: gimp: double-free in read_layer_block()

• https://access.redhat.com/security/cve/CVE-2026-58381 x_refsource_REDHATvdb-entry
• RHBZ#2496166 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/gimp/-/commit/b22e147b
• https://gitlab.gnome.org/GNOME/gimp/-/issues/16207

---

gimp

gimp:2.8/gimp

Needs some backports or patches for stable

NIXPKGS-2026-2063

GitHub issue published 3 weeks, 5 days ago

Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment

Permalink CVE-2026-59093

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 5 days ago
• @LeSuisse ignored
  2 packages

  • python313Packages.weaviate-client
  • python314Packages.weaviate-client
  3 weeks, 5 days ago
• @LeSuisse accepted 3 weeks, 5 days ago
• @LeSuisse published on GitHub 3 weeks, 5 days ago

Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment

• Release Notes release-notes
• Fix PR issue-tracking
• Fix Commit patch
• https://www.vulncheck.com/advisories/weaviate-privilege-escalation-via-unchecke… third-party-advisory

---

weaviate

• <1.38.0

Needs some backports

NIXPKGS-2026-2062

GitHub issue published 3 weeks, 5 days ago

JuiceFS - Authentication Bypass via pprof and metrics Endpoints

Permalink CVE-2026-59092

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 5 days ago
• @LeSuisse ignored reference https://w… 3 weeks, 5 days ago
• @LeSuisse accepted 3 weeks, 5 days ago
• @LeSuisse published on GitHub 3 weeks, 5 days ago

JuiceFS - Authentication Bypass via pprof and metrics Endpoints

• GitHub Issue technical-description
• Fix PR issue-tracking
• Fix Commit patch

Ignored references (1)

• https://www.vulncheck.com/advisories/juicefs-authentication-bypass-via-pprof-an… third-party-advisory

---

juicefs

• ==a46979cdd4082217081ee99b931ddc53d038e47a
• =<1.3.1

NIXPKGS-2026-2061

GitHub issue published 3 weeks, 5 days ago

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

Permalink CVE-2026-58036

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 6 days ago
• @LeSuisse ignored
  2 packages

  • python313Packages.mediawiki-langcodes
  • python314Packages.mediawiki-langcodes
  3 weeks, 5 days ago
• @LeSuisse accepted 3 weeks, 5 days ago
• @LeSuisse published on GitHub 3 weeks, 5 days ago

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

• https://phabricator.wikimedia.org/T425406

---

MediaWiki

• <1.46.0

NIXPKGS-2026-2060

GitHub issue published 3 weeks, 5 days ago

Wasmtime: Leak in WASIp1 `fd_renumber` implementation

Permalink CVE-2026-54786

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 6 days ago
• @LeSuisse ignored
  2 packages

  • python313Packages.wasmtime
  • python314Packages.wasmtime
  3 weeks, 5 days ago
• @LeSuisse accepted 3 weeks, 5 days ago
• @LeSuisse published on GitHub 3 weeks, 5 days ago

Wasmtime: Leak in WASIp1 `fd_renumber` implementation

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3p27-qvp9-27qf x_refsource_CONFIRM

---

wasmtime

• ==>= 37.0.0, < 44.0.3
• ==>= 45.0.0, < 45.0.2
• ==< 24.0.10
• ==>= 25.0.0, < 36.0.11

NIXPKGS-2026-2059

GitHub issue published 3 weeks, 5 days ago

Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration

Permalink CVE-2026-58592

8.9 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 6 days ago
• @LeSuisse accepted 3 weeks, 5 days ago
• @LeSuisse published on GitHub 3 weeks, 5 days ago

Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration

• Proof of Concept exploit
• Affected source product
• VulnCheck Advisory: Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration third-party-advisory

---

Ladybird

• ==0