NIXPKGS-2026-2121

GitHub issue published 5 days, 12 hours ago

ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

Permalink CVE-2026-44512

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse ignored
  39 packages

  • onnxruntime
  • sherpa-onnx
  • pkgsRocm.onnxruntime
  • pkgsRocm.sherpa-onnx
  • python313Packages.onnx
  • python314Packages.onnx
  • python313Packages.onnx-ir
  • python313Packages.tf2onnx
  • python314Packages.onnx-ir
  • python313Packages.onnx-asr
  • python313Packages.onnxslim
  • python313Packages.skl2onnx
  • python314Packages.onnx-asr
  • python314Packages.onnxslim
  • python314Packages.skl2onnx
  • python313Packages.onnxscript
  • python314Packages.onnxscript
  • python313Packages.onnxmltools
  • python313Packages.onnxruntime
  • python313Packages.sherpa-onnx
  • python314Packages.onnxmltools
  • python314Packages.onnxruntime
  • python314Packages.sherpa-onnx
  • python313Packages.optimum-onnx
  • python314Packages.optimum-onnx
  • pkgsRocm.python3Packages.onnx-ir
  • pkgsRocm.python3Packages.tf2onnx
  • pkgsRocm.python3Packages.onnx-asr
  • pkgsRocm.python3Packages.onnxscript
  • python313Packages.onnxruntime-tools
  • python314Packages.onnxruntime-tools
  • pkgsRocm.python3Packages.onnxruntime
  • pkgsRocm.python3Packages.sherpa-onnx
  • pkgsRocm.python3Packages.optimum-onnx
  • python313Packages.onnxconverter-common
  • python313Packages.rapidocr-onnxruntime
  • python314Packages.onnxconverter-common
  • python314Packages.rapidocr-onnxruntime
  • pkgsRocm.python3Packages.rapidocr-onnxruntime
  5 days, 13 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

• https://github.com/onnx/onnx/security/advisories/GHSA-hwpq-hmq9-wj77 x_refsource_CONFIRM
• https://github.com/onnx/onnx/pull/7813 x_refsource_MISC
• https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf x_refsource_MISC
• https://github.com/onnx/onnx/releases/tag/v1.22.0 x_refsource_MISC

---

onnx

• ==>= 1.9.0, < 1.22.0

NIXPKGS-2026-2120

GitHub issue published 5 days, 12 hours ago

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed

Permalink CVE-2026-14454

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse ignored
  10 packages

  • imager
  • usbimager
  • vcdimager
  • rpi-imager
  • gImageReader
  • gimagereader
  • gImageReader-qt
  • gimagereader-qt
  • perlPackages.ImagerQRCode
  • perl5Packages.ImagerQRCode
  5 days, 13 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed

• https://metacpan.org/release/TONYC/Imager-1.033/changes release-notes
• https://github.com/tonycoz/imager/commit/06f01a5d0fd591259aeba589370d6888384a6b… patch
• http://www.openwall.com/lists/oss-security/2026/07/08/6

---

Imager

• <1.033

NIXPKGS-2026-2119

GitHub issue published 5 days, 12 hours ago

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

Permalink CVE-2026-59822

8.8 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

• https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q x_refsource_CONFIRM
• https://github.com/BerriAI/litellm/pull/26463 x_refsource_MISC
• https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c x_refsource_MISC
• https://github.com/BerriAI/litellm/releases/tag/v1.84.0 x_refsource_MISC

---

litellm

• ==< 1.84.0

Needs some backports to stable

NIXPKGS-2026-2118

GitHub issue published 5 days, 12 hours ago

RestrictedPython guard hooks can be shadowed via positional-only arguments

Permalink CVE-2026-55830

8.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

RestrictedPython guard hooks can be shadowed via positional-only arguments

• https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-ffg3-p8fm-mjx2 x_refsource_CONFIRM
• https://github.com/zopefoundation/RestrictedPython/commit/3737596ec9f28c34a073cc845bd2f4c0a80cb671 x_refsource_MISC

---

RestrictedPython

• ==< 8.3

NIXPKGS-2026-2117

GitHub issue published 5 days, 12 hours ago

OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files

Permalink CVE-2026-59261

8.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files

• GitHub Security Advisory (GHSA-4pqj-3c56-5fqq) vendor-advisory
• https://www.vulncheck.com/advisories/openclaw-credential-override-via-workspace… third-party-advisory

---

OpenClaw

• <2026.5.28

The version on the stable branch needs some upgrades

NIXPKGS-2026-2116

GitHub issue published 5 days, 12 hours ago

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

Permalink CVE-2026-54061

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse ignored
  3 packages

  • coqPackages.dpdgraph
  • perlPackages.GDGraph
  • perl5Packages.GDGraph
  5 days, 13 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v x_refsource_CONFIRMexploit
• https://github.com/dgraph-io/dgraph/releases/tag/v25.3.5 x_refsource_MISC

---

dgraph

• ==< 25.3.5

NIXPKGS-2026-2115

GitHub issue published 5 days, 12 hours ago

Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint

Permalink CVE-2026-59806

4.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse ignored
  7 packages

  • python313Packages.gradio-pdf
  • python314Packages.gradio-pdf
  • pkgsRocm.python3Packages.gradio
  • python313Packages.gradio-client
  • python314Packages.gradio-client
  • pkgsRocm.python3Packages.gradio-pdf
  • pkgsRocm.python3Packages.gradio-client
  5 days, 13 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint

• Researcher Disclosure technical-descriptionexploit
• Release Notes release-notes
• Fix PR issue-tracking
• Fix Commit patch
• https://www.vulncheck.com/advisories/gradio-open-redirect-and-ssrf-via-gradio-a… third-party-advisory

---

gradio

• <6.20.0

NIXPKGS-2026-2114

GitHub issue published 5 days, 12 hours ago

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

Permalink CVE-2026-44840

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse ignored
  3 packages

  • coqPackages.dpdgraph
  • perlPackages.GDGraph
  • perl5Packages.GDGraph
  5 days, 13 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc x_refsource_CONFIRM
• https://github.com/dgraph-io/dgraph/commit/cee702c93f141eeb0c96a81f70830ec9e459efac x_refsource_MISC
• https://github.com/dgraph-io/dgraph/releases/tag/v25.3.4 x_refsource_MISC

---

dgraph

• ==< 25.3.4

Needs a backport to stable

NIXPKGS-2026-2113

GitHub issue published 5 days, 12 hours ago

Frigate viewer can read logs exposing admin and camera credentials

Permalink CVE-2026-54652

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse ignored package home-assistant-custom-components.frigate 5 days, 12 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

Frigate viewer can read logs exposing admin and camera credentials

• https://github.com/blakeblackshear/frigate/security/advisories/GHSA-c4qf-xxq4-vf55 x_refsource_CONFIRMexploit
• https://github.com/blakeblackshear/frigate/commit/68e8afd35c76f05f68de47ee9588d2c91796de4b x_refsource_MISC
• https://github.com/blakeblackshear/frigate/commit/bd1fc1cc72cd4fa371464a087cbf3d7f3142edc6 x_refsource_MISC

---

frigate

• ==<= 0.17.1

NIXPKGS-2026-2112

GitHub issue published 5 days, 12 hours ago

Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

Permalink CVE-2026-55542

1.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): Unreported (U)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

• https://github.com/grokability/snipe-it/security/advisories/GHSA-6mmj-jhqj-6c6q x_refsource_CONFIRM
• https://github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259 x_refsource_MISC

---

snipe-it

• ==< 8.5.1