NIXPKGS-2026-2426

GitHub issue published 1 week, 2 days ago

Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows …

Permalink CVE-2026-19587

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 2 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse ignored package libsForQt5.rlottie-qml 1 week, 2 days ago
• @LeSuisse accepted 1 week, 2 days ago
• @LeSuisse published on GitHub 1 week, 2 days ago

Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows …

• https://github.com/Samsung/rlottie/pull/599

---

rlottie

• ==87e166c0a72b6f3110083dd6de0e47dcb9e1c2b5

NIXPKGS-2026-2425

GitHub issue published 1 week, 2 days ago

jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

Permalink CVE-2026-73415

7.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 2 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse ignored
  16 packages

  • python313Packages.jupyterlab-git
  • python313Packages.jupyterlab-lsp
  • python313Packages.jupyterlab-vim
  • python314Packages.jupyterlab-git
  • python314Packages.jupyterlab-lsp
  • python314Packages.jupyterlab-vim
  • python313Packages.jupyterlab-server
  • python314Packages.jupyterlab-server
  • python313Packages.jupyterlab-widgets
  • python314Packages.jupyterlab-widgets
  • python313Packages.jupyterlab-git-core
  • python313Packages.jupyterlab-pygments
  • python314Packages.jupyterlab-git-core
  • python314Packages.jupyterlab-pygments
  • python313Packages.jupyterlab-execute-time
  • python314Packages.jupyterlab-execute-time
  1 week, 2 days ago
• @LeSuisse accepted 1 week, 2 days ago
• @LeSuisse published on GitHub 1 week, 2 days ago

jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c x_refsource_CONFIRM
• https://github.com/jupyterlab/jupyterlab/pull/19184 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/pull/19185 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/pull/19186 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1 x_refsource_MISC

---

jupyterlab

• ==< 4.5.10
• ==>= 4.6.0, < 4.6.2

NIXPKGS-2026-2424

GitHub issue published 1 week, 2 days ago

Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

Permalink CVE-2026-73291

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 week, 2 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse ignored
  4 packages

  • overseerr
  • jellyseerr
  • python313Packages.python-overseerr
  • python314Packages.python-overseerr
  1 week, 2 days ago
• @LeSuisse accepted 1 week, 2 days ago
• @LeSuisse published on GitHub 1 week, 2 days ago

Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

• https://github.com/seerr-team/seerr/security/advisories/GHSA-mc6w-69r3-62h8 x_refsource_CONFIRM
• https://github.com/seerr-team/seerr/commit/f484791105bd81bd5404e01410431ee6fe5769c2 x_refsource_MISC
• https://github.com/seerr-team/seerr/releases/tag/v3.4.0 x_refsource_MISC

---

seerr

• ==< 3.4.0

Backport needed

NIXPKGS-2026-2423

GitHub issue published 1 week, 2 days ago

YesWiki: Unauthenticated SQL Injection

Permalink CVE-2026-46670

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 week, 2 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 3 days ago
• @LeSuisse accepted 1 week, 2 days ago
• @LeSuisse published on GitHub 1 week, 2 days ago

YesWiki: Unauthenticated SQL Injection

• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-jwvv-qr7q-cv8j x_refsource_CONFIRM

---

yeswiki

• ==< 4.6.4

NIXPKGS-2026-2422

GitHub issue published 1 week, 2 days ago

CVE-2026-19516 CVE Record

Permalink CVE-2026-19516

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 1 week, 2 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 3 days ago
• @LeSuisse accepted 1 week, 2 days ago
• @LeSuisse published on GitHub 1 week, 2 days ago

CVE-2026-19516 CVE Record

• https://grafana.com/security/security-advisories/cve-2026-19516 vendor-advisory

---

mcp-grafana

• =<1.0.0

Grafana MCP Server

• =<1.0.0

Needs something for 26.05

NIXPKGS-2026-2421

GitHub issue published 1 week, 2 days ago

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Permalink CVE-2026-73245

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 week, 2 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 3 days ago
• @LeSuisse accepted 1 week, 2 days ago
• @LeSuisse published on GitHub 1 week, 2 days ago

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

• https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7 x_refsource_CONFIRM

---

kestra

• ==< 2.0.0-rc6

NIXPKGS-2026-2420

GitHub issue published 1 week, 2 days ago

Snipe-IT Checkout Request Cancellation IDOR

Permalink CVE-2026-19579

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 2 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 3 days ago
• @LeSuisse accepted 1 week, 2 days ago
• @LeSuisse published on GitHub 1 week, 2 days ago

Snipe-IT Checkout Request Cancellation IDOR

• https://github.com/snipe/snipe-it/releases/tag/v8.6.0
• https://www.tenable.com/security/research/tra-2026-54

---

Snipe-IT

• <8.6.0

NIXPKGS-2026-2419

GitHub issue published 1 week, 2 days ago

Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture

Permalink CVE-2026-73210

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 2 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 3 days ago
• @LeSuisse accepted 1 week, 2 days ago
• @LeSuisse published on GitHub 1 week, 2 days ago

Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture

• https://github.com/Lookyloo/PlaywrightCapture/commit/5e6679717e97f7a18bb71d00a1… patch

---

PlaywrightCapture

• <1.40.6

NIXPKGS-2026-2418

GitHub issue published 1 week, 2 days ago

ffuf denial of service (OOM) via HTTP response decompression bomb

Permalink CVE-2026-73232

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 2 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 3 days ago
• @LeSuisse accepted 1 week, 2 days ago
• @LeSuisse published on GitHub 1 week, 2 days ago

ffuf denial of service (OOM) via HTTP response decompression bomb

• https://github.com/ffuf/ffuf/security/advisories/GHSA-jcvh-xf52-2cwm x_refsource_CONFIRM
• https://github.com/ffuf/ffuf/pull/897 x_refsource_MISC
• https://github.com/ffuf/ffuf/commit/fb0da86c60443b0dddbc9a86e91e3a6487dff79b x_refsource_MISC
• https://github.com/ffuf/ffuf/releases/tag/v2.2.0 x_refsource_MISC

---

ffuf

• ==< 2.2.0

NIXPKGS-2026-2417

GitHub issue published 1 week, 2 days ago

Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet

Permalink CVE-2026-72712

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 2 days ago by @LeSuisse Activity log

• Created suggestion 1 week, 3 days ago
• @LeSuisse ignored
  21 packages

  • asnmap
  • genmap
  • zenmap
  • nmap-parse
  • nmap-formatter
  • python313Packages.chainmap
  • python314Packages.chainmap
  • coqPackages.mathcomp-finmap
  • python313Packages.nmapthon2
  • python314Packages.nmapthon2
  • rocqPackages.mathcomp-finmap
  • python313Packages.python-nmap
  • python314Packages.python-nmap
  • python313Packages.dragonmapper
  • python313Packages.python3-nmap
  • python314Packages.dragonmapper
  • python314Packages.python3-nmap
  • python313Packages.deep-chainmap
  • python314Packages.deep-chainmap
  • python313Packages.python-libnmap
  • python314Packages.python-libnmap
  1 week, 2 days ago
• @LeSuisse accepted 1 week, 2 days ago
• @LeSuisse published on GitHub 1 week, 2 days ago

Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet

• Product Repository product
• GitHub Issue issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/nmap-denial-of-service-via-zero-length-tcp… third-party-advisory

---

Nmap

• =<7.99