NIXPKGS-2026-2008

GitHub issue published 1 month ago

Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format

Permalink CVE-2026-47220

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  11 packages

  • envoy
  • opa-envoy-plugin
  • python312Packages.envoy-utils
  • python313Packages.envoy-utils
  • python314Packages.envoy-utils
  • python312Packages.envoy-reader
  • python313Packages.envoy-reader
  • python314Packages.envoy-reader
  • python313Packages.envoy-data-plane
  • python314Packages.envoy-data-plane
  • home-assistant-component-tests.enphase_envoy
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-j9wh-4qfm-wf2v x_refsource_CONFIRM

---

envoy

• ==>= 1.37.0, < 1.37.5
• ==>= 1.38.0, < 1.38.3

NIXPKGS-2026-2007

GitHub issue published 1 month ago

Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)

Permalink CVE-2026-48090

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  11 packages

  • opa-envoy-plugin
  • python312Packages.envoy-utils
  • python313Packages.envoy-utils
  • python314Packages.envoy-utils
  • python312Packages.envoy-reader
  • python313Packages.envoy-reader
  • python314Packages.envoy-reader
  • python313Packages.envoy-data-plane
  • python314Packages.envoy-data-plane
  • home-assistant-component-tests.enphase_envoy
  • envoy
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cj2-c63f-q26f x_refsource_CONFIRM

---

envoy

• ==>= 1.37.0, < 1.37.5
• ==>= 1.38.0, < 1.38.3

NIXPKGS-2026-2006

GitHub issue published 1 month ago

Hydra - Stack Buffer Overflow in NTLM Authentication Handler

Permalink CVE-2026-56766

8.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Hydra - Stack Buffer Overflow in NTLM Authentication Handler

• Patch Commit patch
• https://www.vulncheck.com/advisories/hydra-stack-buffer-overflow-in-ntlm-authen… third-party-advisory

---

thc-hydra

• ==9cc84c20e75f5fef6bb1790bb9ada2afad2204e2
• =<9.7

NIXPKGS-2026-2005

GitHub issue published 1 month ago

socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser

Permalink CVE-2026-56123

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored package websocat 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser

• http://www.dest-unreach.org/socat/CHANGES release-notespatch
• https://www.vulncheck.com/advisories/socat-heap-buffer-overflow-via-socks5-repl… third-party-advisory

---

socat

• <1.8.1.2

NIXPKGS-2026-2004

GitHub issue published 1 month ago

Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy

Permalink CVE-2026-54573

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  17 packages

  • go-outline
  • mdbook-pdf-outline
  • typstPackages.suboutline
  • python312Packages.outlines
  • python313Packages.outlines
  • typstPackages.suboutline_0_1_0
  • typstPackages.suboutline_0_2_0
  • typstPackages.suboutline_0_3_0
  • mplus-outline-fonts.osdnRelease
  • python312Packages.outlines-core
  • python313Packages.outlines-core
  • python314Packages.outlines-core
  • typstPackages.outline-summaryst
  • mplus-outline-fonts.githubRelease
  • pkgsRocm.python3Packages.outlines
  • typstPackages.outline-summaryst_0_1_0
  • pkgsRocm.python3Packages.outlines-core
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy

• https://github.com/outline/outline/security/advisories/GHSA-5x79-rj4g-qrh8 x_refsource_CONFIRM

---

outline

• ==< 1.8.0

Needs some backports

NIXPKGS-2026-2003

GitHub issue published 1 month ago

Halo: Path Traversal in Backup Download Leads to Arbitrary File Read

Permalink CVE-2026-55439

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  14 packages

  • eschalot
  • python312Packages.halo
  • python313Packages.halo
  • python314Packages.halo
  • typstPackages.whalogen
  • python312Packages.halohome
  • python313Packages.halohome
  • python314Packages.halohome
  • typstPackages.whalogen_0_1_0
  • typstPackages.whalogen_0_2_0
  • typstPackages.whalogen_0_3_0
  • python312Packages.django-cachalot
  • python313Packages.django-cachalot
  • python314Packages.django-cachalot
  1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Halo: Path Traversal in Backup Download Leads to Arbitrary File Read

• https://github.com/halo-dev/halo/security/advisories/GHSA-h8wj-chr2-hf66 x_refsource_CONFIRM
• https://github.com/halo-dev/halo/issues/10064 x_refsource_MISCexploit

---

halo

• ==< 2.24.3

NIXPKGS-2026-2002

GitHub issue published 1 month ago

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

Permalink CVE-2026-54917

7.8 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv x_refsource_CONFIRMexploit
• https://github.com/seaweedfs/seaweedfs/pull/9687 x_refsource_MISC

---

seaweedfs

• ==< 4.30

Needs some backports

NIXPKGS-2026-2001

GitHub issue published 1 month ago

Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID

Permalink CVE-2026-56774

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID

• Researcher Disclosure technical-descriptionexploit
• Pull Request issue-tracking
• Patch Commit patch
• https://www.vulncheck.com/advisories/kanboard-cross-user-deletion-of-persistent… third-party-advisory

---

kanboard

• ==928c68aa2b7c00092dd71084d329b912e229f3d1
• =<1.2.52

NIXPKGS-2026-2000

GitHub issue published 1 month ago

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Permalink CVE-2026-49980

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored
  9 packages

  • librclone
  • rclone-ui
  • syncrclone
  • rclone-browser
  • git-annex-remote-rclone
  • gnomeExtensions.rclone-manager
  • python312Packages.rclone-python
  • python313Packages.rclone-python
  • python314Packages.rclone-python
  1 month ago
• @LeSuisse ignored maintainer @SuperSandro2000 1 month ago maintainer.ignore
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

• https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv x_refsource_CONFIRM

---

rclone

• ==>= 1.46.0, < 1.74.3

NIXPKGS-2026-1999

GitHub issue published 1 month ago

trivy: security issues < 0.71.1

Permalink CVE-2026-54448

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored package lazytrivy 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4 x_refsource_CONFIRMexploit
• https://github.com/aquasecurity/trivy/pull/10718 x_refsource_MISCexploit

---

trivy

• ==< 0.71.0

Permalink CVE-2026-55092

7.0 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 month ago by @LeSuisse Activity log

• Created suggestion 1 month ago
• @LeSuisse ignored package lazytrivy 1 month ago
• @LeSuisse accepted 1 month ago
• @LeSuisse published on GitHub 1 month ago

Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts

• https://github.com/aquasecurity/trivy/security/advisories/GHSA-mcj4-mphf-j9ff x_refsource_CONFIRM

---

trivy

• ==< 0.71.1