NIXPKGS-2026-2318

GitHub issue published 1 month, 2 weeks ago

Insufficient verification of Hex package metadata in Gleam

Permalink CVE-2026-59247

7.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored
  5 packages

  • vscode-extensions.gleam.gleam
  • tree-sitter-grammars.tree-sitter-gleam
  • vimPlugins.nvim-treesitter-parsers.gleam
  • python313Packages.tree-sitter-grammars.tree-sitter-gleam
  • python314Packages.tree-sitter-grammars.tree-sitter-gleam
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Insufficient verification of Hex package metadata in Gleam

• https://github.com/gleam-lang/gleam/security/advisories/GHSA-4vvc-458m-r82g vendor-advisoryrelated
• https://cna.erlef.org/cves/CVE-2026-59247.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-59247 related
• https://github.com/gleam-lang/gleam/commit/c9c0d48c123c8abae6db8dd61b25ccb427ed… patch
• https://github.com/hexpm/specifications/blob/main/registry-v2.md related

---

gleam.run/gleam

• <1.18.0

gleam-lang/gleam

• <v1.18.0-elixir-alpine
• <v1.18.0-node
• <1.18.0
• <v1.18.0-erlang
• <v1.18.0-node-slim
• <c9c0d48c123c8abae6db8dd61b25ccb427ed3d35
• <v1.18.0-elixir
• <v1.18.0-erlang-alpine
• <v1.18.0-scratch
• <v1.18.0-erlang-slim
• <v1.18.0-node-alpine
• <v1.18.0-elixir-slim

NIXPKGS-2026-2317

GitHub issue published 1 month, 2 weeks ago

Arbitrary Command Execution in GNU Bison

Permalink CVE-2026-56389

6.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored package bisoncpp 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Arbitrary Command Execution in GNU Bison

• https://cert.pl/en/posts/2026/07/CVE-2026-56389 third-party-advisory
• https://cgit.git.savannah.gnu.org/cgit/bison.git/ product
• https://cgit.git.savannah.gnu.org/cgit/bison.git/commit/?id=3169c1e7a2c6acc4c59… patch

---

Bison

• ==3.8.2

NIXPKGS-2026-2316

GitHub issue published 1 month, 2 weeks ago

pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems

Permalink CVE-2026-18022

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored
  9 packages

  • python314Packages.pgvector
  • python313Packages.pgvector
  • postgresqlPackages.pgvectorscale
  • postgresql14Packages.pgvectorscale
  • postgresql15Packages.pgvectorscale
  • postgresql16Packages.pgvectorscale
  • postgresql17Packages.pgvectorscale
  • postgresql19Packages.pgvectorscale
  • postgresql18Packages.pgvectorscale
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems

• https://github.com/pgvector/pgvector/issues/1006
• https://github.com/pgvector/pgvector/commit/636a92a3395d2e036ffd40d07aeb400a708…

---

pgvector

• <0.8.6

NIXPKGS-2026-2315

GitHub issue published 1 month, 2 weeks ago

ZITADEL Users Can Self-Verify Email/Phone via API

Permalink CVE-2026-54693

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored package zitadel-tools 1 month, 2 weeks ago
• @LeSuisse ignored
  2 references

  • https://github.com/zitadel/zitadel/rele…
  • https://github.com/zitadel/zitadel/rele…
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

ZITADEL Users Can Self-Verify Email/Phone via API

• https://github.com/zitadel/zitadel/security/advisories/GHSA-jq8w-8q2f-ffm9 x_refsource_CONFIRM
• https://github.com/zitadel/zitadel/commit/90f310212d3a5075084a603bf61fed549c92956d x_refsource_MISC
• https://github.com/zitadel/zitadel/commit/a1748b2f0326ddf7be0de44b4f980ae2c07c0151 x_refsource_MISC
• https://github.com/zitadel/zitadel/commit/ed09b3df7f43e870423e4d8f2757e6894481604f x_refsource_MISC

Ignored references (2)

• https://github.com/zitadel/zitadel/releases/tag/v3.4.11 x_refsource_MISC
• https://github.com/zitadel/zitadel/releases/tag/v4.15.1 x_refsource_MISC

---

zitadel

• ==>= 4.0.0-rc.1, < 4.15.1
• ==>= 2.43.0, <= 2.71.19
• ==>= 3.0.0-rc.1, < 3.4.11

NIXPKGS-2026-2314

GitHub issue published 1 month, 2 weeks ago

Terminal Escape Injection in diff‑so‑fancy

Permalink CVE-2026-50642

4.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

Terminal Escape Injection in diff‑so‑fancy

• https://cert.pl/posts/2026/07/CVE-2026-41874/ third-party-advisory
• https://github.com/so-fancy/diff-so-fancy product

---

diff-so-fancy

• =<1.4.10

NIXPKGS-2026-2313

GitHub issue published 1 month, 2 weeks ago

openiscsi: security issues < 2.1.12

Permalink CVE-2026-44944

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

iscsiuio control-socket authentication bypass in open-iscsi

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44944
• https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9…

---

open-iscsi

• =<668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e

Fixed in 2.1.12, needs backport.

Permalink CVE-2026-44943

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

remote limited file-write as root via discovery in open-iscsi

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44943
• https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9…

---

open-iscsi

• =<668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e

Fixed in 2.1.12, needs backport.

NIXPKGS-2026-2312

GitHub issue published 1 month, 2 weeks ago

cjson: security issues <= 1.7.19

Permalink CVE-2026-67216

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored
  16 packages

  • fracjson
  • luaPackages.cjson
  • lua51Packages.cjson
  • lua52Packages.cjson
  • lua53Packages.cjson
  • lua54Packages.cjson
  • lua55Packages.cjson
  • luajitPackages.cjson
  • luaPackages.lua-cjson
  • chickenPackages_5.chickenEggs.cjson
  • luajitPackages.lua-cjson
  • lua55Packages.lua-cjson
  • lua54Packages.lua-cjson
  • lua53Packages.lua-cjson
  • lua52Packages.lua-cjson
  • lua51Packages.lua-cjson
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

cJSON cJSON_Compare Exponential Complexity Denial of Service

• Security vulnerabilities in the cJSON JSON parser (Joshua Rogers) exploit
• cJSON_Compare double-recursion object comparison (cJSON.c) technical-description
• VulnCheck Advisory: cJSON cJSON_Compare Exponential Complexity Denial of Service third-party-advisory

---

cJSON

• =<1.7.19

Permalink CVE-2026-67215

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored
  16 packages

  • fracjson
  • luaPackages.cjson
  • lua51Packages.cjson
  • lua52Packages.cjson
  • lua53Packages.cjson
  • lua54Packages.cjson
  • lua55Packages.cjson
  • luajitPackages.cjson
  • luaPackages.lua-cjson
  • lua51Packages.lua-cjson
  • lua52Packages.lua-cjson
  • lua53Packages.lua-cjson
  • lua54Packages.lua-cjson
  • lua55Packages.lua-cjson
  • luajitPackages.lua-cjson
  • chickenPackages_5.chickenEggs.cjson
  1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion

• Security vulnerabilities in the cJSON JSON parser (Joshua Rogers) exploit
• cJSON_Delete unbounded recursion (cJSON.c) technical-description
• apply_patch copy/add duplicate-and-graft (cJSON_Utils.c) technical-description
• VulnCheck Advisory: cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion third-party-advisory

---

cJSON

• =<1.7.19

Permalink CVE-2026-67217

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse ignored
  17 packages

  • fracjson
  • luaPackages.cjson
  • lua51Packages.cjson
  • lua52Packages.cjson
  • lua53Packages.cjson
  • lua54Packages.cjson
  • lua55Packages.cjson
  • luajitPackages.cjson
  • cjson
  • chickenPackages_5.chickenEggs.cjson
  • luajitPackages.lua-cjson
  • lua55Packages.lua-cjson
  • lua54Packages.lua-cjson
  • lua53Packages.lua-cjson
  • lua52Packages.lua-cjson
  • lua51Packages.lua-cjson
  • luaPackages.lua-cjson
  1 month, 2 weeks ago
• @LeSuisse restored package cjson 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

• Security vulnerabilities in the cJSON JSON parser (Joshua Rogers) exploit
• apply_patch delete-before-validate ordering (cJSON_Utils.c) technical-description
• VulnCheck Advisory: cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation third-party-advisory

---

cJSON

• =<1.7.19

NIXPKGS-2026-2311

GitHub issue published 1 month, 2 weeks ago

swagger-typescript-api: security issues <= 13.12.1

Permalink CVE-2026-54662

8.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

• https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67 x_refsource_CONFIRMexploit
• https://github.com/acacode/swagger-typescript-api/pull/1779 x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 x_refsource_MISC

---

swagger-typescript-api

• ==< 13.12.2

Permalink CVE-2026-54663

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

• https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-x36r-4347-pm5x x_refsource_CONFIRMexploit
• https://github.com/acacode/swagger-typescript-api/pull/1779 x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 x_refsource_MISC

---

swagger-typescript-api

• ==< 13.12.2

Permalink CVE-2026-54660

7.4 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

• https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-h754-fxp7-88wx x_refsource_CONFIRM
• https://github.com/acacode/swagger-typescript-api/pull/1779 x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 x_refsource_MISC

---

swagger-typescript-api

• ==< 13.12.2

Permalink CVE-2026-54661

8.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

• https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-38c3-wv3c-v3xj x_refsource_CONFIRM
• https://github.com/acacode/swagger-typescript-api/pull/1779 x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 x_refsource_MISC

---

swagger-typescript-api

• ==< 13.12.2

Permalink CVE-2026-54666

8.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

• https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-w284-33mx-6g9v x_refsource_CONFIRM
• https://github.com/acacode/swagger-typescript-api/pull/1779 x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 x_refsource_MISC

---

swagger-typescript-api

• ==< 13.12.2

Permalink CVE-2026-54664

8.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

swagger-typescript-api vulnerable to code injection via unescaped enum string values

• https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-5f94-x226-ccpm x_refsource_CONFIRM
• https://github.com/acacode/swagger-typescript-api/pull/1779 x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de x_refsource_MISC
• https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 x_refsource_MISC

---

swagger-typescript-api

• ==< 13.12.2

NIXPKGS-2026-2310

GitHub issue published 1 month, 2 weeks ago

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

Permalink CVE-2026-52791

2.0 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

• https://github.com/containers/fuse-overlayfs/security/advisories/GHSA-2cc4-p72c-v85h x_refsource_CONFIRMexploit
• https://github.com/containers/fuse-overlayfs/commit/97e0d968a782fc259ebde112db1e9b9ff1ad724f x_refsource_MISC
• https://github.com/containers/fuse-overlayfs/releases/tag/v1.17 x_refsource_MISC

---

fuse-overlayfs

• ==< 1.17

Needs backport

NIXPKGS-2026-2309

GitHub issue published 1 month, 2 weeks ago

OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

Permalink CVE-2026-67439

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 1 month, 2 weeks ago
• @LeSuisse accepted 1 month, 2 weeks ago
• @LeSuisse published on GitHub 1 month, 2 weeks ago

OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jm28-2wcr-qf3h x_refsource_CONFIRM
• https://github.com/OliveTin/OliveTin/commit/e421780c9885aa5024d2f47b4ed4898f2f18eb90 x_refsource_MISC
• https://github.com/OliveTin/OliveTin/releases/tag/3000.17.0 x_refsource_MISC

---

OliveTin

• ==< 3000.17.0