NIXPKGS-2026-2533

GitHub issue published 5 days, 9 hours ago

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

Permalink CVE-2026-86219

updated 5 days, 9 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 17 hours ago
• @LeSuisse ignored
  2 packages

  • perlPackages.AuthenSASLSASLprep
  • perl5Packages.AuthenSASLSASLprep
  5 days, 12 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 9 hours ago

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

• https://metacpan.org/release/EHUELS/Authen-SASL-2.2000/source/lib/Authen/SASL/P…
• https://metacpan.org/release/EHUELS/Authen-SASL-2.2000/source/lib/Authen/SASL/P…
• https://datatracker.ietf.org/doc/html/rfc2831#section-2.1.2
• https://github.com/perl-authen-sasl/perl-authen-sasl/commit/9433736703061284292… patch
• https://metacpan.org/release/EHUELS/Authen-SASL-2.2100/changes release-notes
• https://www.cve.org/CVERecord?id=CVE-2025-40918 related

---

Authen-SASL

• <2.2100

NIXPKGS-2026-2532

GitHub issue published 5 days, 21 hours ago

SiYuan before v3.8.2 Private Attribute View Key Enumeration

Permalink CVE-2026-86191

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 21 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse ignored
  3 maintainers

  • @TomaSajt
  • @mtul0729
  • @L-Trump
  5 days, 21 hours ago maintainer.ignore
• @LeSuisse published on GitHub 5 days, 21 hours ago

SiYuan before v3.8.2 Private Attribute View Key Enumeration

• GitHub Security Advisory (GHSA-j4qq-w6qx-6839) vendor-advisory
• VulnCheck Advisory: SiYuan before v3.8.2 Private Attribute View Key Enumeration third-party-advisory

---

siyuan

• <3.8.2
• ==3.8.2

NIXPKGS-2026-2531

GitHub issue published 5 days, 21 hours ago

Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

Permalink CVE-2026-86197

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 21 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  19 packages

  • haskellPackages.gravatar
  • gravit
  • antigravity
  • antigravity-cli
  • antigravity-fhs
  • antigravity-ide
  • antigravity-ide-fhs
  • stardust-xr-gravity
  • kdePackages.libgravatar
  • bulwark-plugins.gravatar
  • gnomeExtensions.gravatar
  • python313Packages.libgravatar
  • python314Packages.libgravatar
  • python314Packages.flask-gravatar
  • python313Packages.django-gravatar2
  • python313Packages.flask-gravatar
  • python314Packages.django-gravatar2
  • perlPackages.MojoliciousPluginGravatar
  • perl5Packages.MojoliciousPluginGravatar
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 5 days, 21 hours ago

Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

• GitHub Security Advisory (GHSA-8hgv-xc77-jmcr) vendor-advisory
• VulnCheck Advisory: Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox third-party-advisory

---

grav

• <2.0.20
• ==2.0.20

NIXPKGS-2026-2530

GitHub issue published 5 days, 21 hours ago

NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

Permalink CVE-2026-86175

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 21 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  63 packages

  • netbox2netshot
  • pkgsRocm.netbox
  • pkgsRocm.netbox_4_4
  • netboxPlugins.netbox-bgp
  • netboxPlugins.netbox-dns
  • netboxPlugins.netbox-lists
  • python313Packages.pynetbox
  • python314Packages.pynetbox
  • netboxPlugins.netbox-qrcode
  • netboxPlugins.netbox-routing
  • netboxPlugins.netbox-secrets
  • python313Packages.netbox-bgp
  • python314Packages.netbox-bgp
  • python314Packages.netbox-dns
  • netboxPlugins.netbox-contract
  • netboxPlugins.netbox-security
  • netboxPlugins.netbox-documents
  • netboxPlugins.netbox-inventory
  • netboxPlugins.netbox-lifecycle
  • netboxPlugins.netbox-data-flows
  • python314Packages.netbox-qrcode
  • netboxPlugins.netbox-attachments
  • python313Packages.netbox-routing
  • python314Packages.netbox-routing
  • netboxPlugins.netbox-contextmenus
  • terraform-providers.e-breuninger_netbox
  • python313Packages.netbox-dns
  • python313Packages.netbox-qrcode
  • netboxPlugins.netbox-reorder-rack
  • python313Packages.netbox-contract
  • netboxPlugins.netbox-config-backup
  • netboxPlugins.netbox-napalm-plugin
  • python313Packages.netbox-documents
  • python314Packages.netbox-documents
  • netboxPlugins.netbox-custom-objects
  • netboxPlugins.netbox-topology-views
  • pkgsRocm.python3Packages.netbox-bgp
  • python313Packages.netbox-attachments
  • netboxPlugins.netbox-floorplan-plugin
  • python313Packages.netbox-contextmenus
  • python313Packages.netbox-reorder-rack
  • python314Packages.netbox-contextmenus
  • python314Packages.netbox-reorder-rack
  • pkgsRocm.python3Packages.netbox-qrcode
  • python313Packages.netbox-napalm-plugin
  • pkgsRocm.python3Packages.netbox-routing
  • python313Packages.netbox-topology-views
  • pkgsRocm.python3Packages.netbox-contract
  • netboxPlugins.netbox-plugin-prometheus-sd
  • pkgsRocm.python3Packages.netbox-documents
  • python313Packages.netbox-floorplan-plugin
  • pkgsRocm.python3Packages.netbox-attachments
  • pkgsRocm.python3Packages.netbox-reorder-rack
  • pkgsRocm.python3Packages.netbox-napalm-plugin
  • python313Packages.netbox-plugin-prometheus-sd
  • python314Packages.netbox-plugin-prometheus-sd
  • netboxPlugins.netbox-interface-synchronization
  • pkgsRocm.python3Packages.netbox-topology-views
  • pkgsRocm.python3Packages.netbox-floorplan-plugin
  • python313Packages.netbox-interface-synchronization
  • python314Packages.netbox-interface-synchronization
  • pkgsRocm.python3Packages.netbox-plugin-prometheus-sd
  • pkgsRocm.python3Packages.netbox-interface-synchronization
  5 days, 22 hours ago
• @LeSuisse restored package pkgsRocm.netbox_4_4 5 days, 22 hours ago
• @LeSuisse accepted 5 days, 22 hours ago
• @LeSuisse published on GitHub 5 days, 21 hours ago

NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

• Researcher Advisory third-party-advisoryexploit
• DataSourceSerializer Meta.fields technical-description
• DataSourceType GraphQL fields technical-description
• GitBackend sensitive_parameters technical-description
• GitHub Issue #12625 issue-tracking
• https://github.com/netbox-community/netbox product
• VulnCheck Advisory: NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs third-party-advisory

---

netbox

• =<4.7.0

NIXPKGS-2026-2529

GitHub issue published 5 days, 21 hours ago

Pixelfed through 0.12.9 Unauthorized Story Access via API

Permalink CVE-2026-86178

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 21 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse accepted 5 days, 21 hours ago
• @LeSuisse published on GitHub 5 days, 21 hours ago

Pixelfed through 0.12.9 Unauthorized Story Access via API

• Researcher Advisory third-party-advisoryexploit
• StoryComposeController react technical-description
• StoryComposeController comment technical-description
• Story react and comment routes technical-description
• https://github.com/pixelfed/pixelfed product
• VulnCheck Advisory: Pixelfed through 0.12.9 Unauthorized Story Access via API third-party-advisory

---

pixelfed

• =<0.12.9

NIXPKGS-2026-2528

GitHub issue published 5 days, 21 hours ago

gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

Permalink CVE-2026-86118

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 21 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse accepted 5 days, 21 hours ago
• @LeSuisse published on GitHub 5 days, 21 hours ago

gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

• GitHub Security Advisory (GHSA-453r-pgfw-h3pq) vendor-advisory
• ServeStartScan without an admin check technical-description
• /startScan registered on the plain auth chain technical-description
• gonic v0.22.0 Release Notes release-notes
• https://github.com/sentriz/gonic product
• VulnCheck Advisory: gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint third-party-advisory

---

gonic

• <0.22.0

Needs a backport.

NIXPKGS-2026-2527

GitHub issue published 5 days, 21 hours ago

Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

Permalink CVE-2026-86116

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 21 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse accepted 5 days, 21 hours ago
• @LeSuisse published on GitHub 5 days, 21 hours ago

Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

• Researcher write-up technical-description
• Glossary POST/PUT/DELETE with no authorization check technical-description
• Restrict glossary permissions (#76275) patch
• metabase v0.63.1 Release Notes release-notes
• https://github.com/metabase/metabase product
• VulnCheck Advisory: Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API third-party-advisory

---

metabase

• <0.63.1

Needs a backport

NIXPKGS-2026-2526

GitHub issue published 5 days, 22 hours ago

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse …

Permalink CVE-2026-86145

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 5 days, 22 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  12 packages

  • jpcre2
  • ocamlPackages.pcre2
  • haskellPackages.pcre2
  • luaPackages.lrexlib-pcre2
  • ocamlPackages_latest.pcre2
  • haskellPackages.regex-pcre2
  • lua51Packages.lrexlib-pcre2
  • lua52Packages.lrexlib-pcre2
  • lua53Packages.lrexlib-pcre2
  • lua54Packages.lrexlib-pcre2
  • lua55Packages.lrexlib-pcre2
  • luajitPackages.lrexlib-pcre2
  6 days, 3 hours ago
• @LeSuisse accepted 5 days, 22 hours ago
• @LeSuisse published on GitHub 5 days, 22 hours ago

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse …

• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf
• https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
• http://www.openwall.com/lists/oss-security/2026/09/05/3

---

PCRE2

• <10.48

NIXPKGS-2026-2525

GitHub issue published 6 days, 8 hours ago

libpcap: security issues < 1.10.7

Permalink CVE-2026-31911

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  3 packages

  • darwin.libpcap
  • python313Packages.libpcap
  • python314Packages.libpcap
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

abort() in libpcap before 1.10.7 on an invalid BPF opcode

• https://github.com/the-tcpdump-group/libpcap/commit/a715bcdde830299cba417151438… patch

---

libpcap

• <1.10.7

Permalink CVE-2026-0799

8.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  3 packages

  • darwin.libpcap
  • python313Packages.libpcap
  • python314Packages.libpcap
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

OOBR and OOBW in libpcap before 1.10.7

• https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e… patch

---

libpcap

• <1.10.7

Permalink CVE-2026-18238

5.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  3 packages

  • darwin.libpcap
  • python314Packages.libpcap
  • python313Packages.libpcap
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

OOBR in rpcap client in libpcap before 1.10.7

• https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae… patch

---

libpcap

• <1.10.7
• ==1.9.x
• ==1.8.x

Permalink CVE-2026-6554

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  3 packages

  • darwin.libpcap
  • python313Packages.libpcap
  • python314Packages.libpcap
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

infinte loop in libpcap before 1.10.7

• https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b… patch

---

libpcap

• <1.10.7

Permalink CVE-2026-31912

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  3 packages

  • darwin.libpcap
  • python313Packages.libpcap
  • python314Packages.libpcap
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

OOBR in libpcap before 1.10.7

• https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e… patch

---

libpcap

• <1.10.7

Permalink CVE-2026-6244

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  3 packages

  • python314Packages.libpcap
  • python313Packages.libpcap
  • darwin.libpcap
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

division by zero in libpcap before 1.10.7

• https://github.com/the-tcpdump-group/libpcap/commit/98bb921b141aa642faedbf2ac51… patch

---

libpcap

• <1.10.7

Permalink CVE-2026-18313

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  3 packages

  • darwin.libpcap
  • python313Packages.libpcap
  • python314Packages.libpcap
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

rpcapd memory leak in libpcap before 1.10.7

• https://github.com/the-tcpdump-group/libpcap/commit/f9775af1a0ec76db60c7213241e… patch

---

libpcap

• <1.10.7
• ==1.9.x

NIXPKGS-2026-2524

GitHub issue published 6 days, 8 hours ago

libxml2: security issues < 2.15.4

Permalink CVE-2026-86143

6.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  7 packages

  • libxml2_13
  • libxml2Python
  • sbclPackages.cl-libxml2
  • perlPackages.AlienLibxml2
  • python313Packages.libxml2
  • python314Packages.libxml2
  • perl5Packages.AlienLibxml2
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback …

• https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
• https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35
• https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111

---

libxml2

• <2.15.4

Permalink CVE-2026-86142

6.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  7 packages

  • libxml2_13
  • libxml2Python
  • sbclPackages.cl-libxml2
  • perlPackages.AlienLibxml2
  • python313Packages.libxml2
  • python314Packages.libxml2
  • perl5Packages.AlienLibxml2
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

In libxml2 before 2.15.4, there is a heap-based buffer overflow …

• https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
• https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58
• https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113

---

libxml2

• <2.15.4

Permalink CVE-2026-86138

6.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  7 packages

  • libxml2_13
  • libxml2Python
  • sbclPackages.cl-libxml2
  • perlPackages.AlienLibxml2
  • python313Packages.libxml2
  • python314Packages.libxml2
  • perl5Packages.AlienLibxml2
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer …

• https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
• https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4

---

libxml2

• <2.15.4

Permalink CVE-2026-86144

5.6 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  7 packages

  • libxml2Python
  • sbclPackages.cl-libxml2
  • perlPackages.AlienLibxml2
  • python313Packages.libxml2
  • python314Packages.libxml2
  • perl5Packages.AlienLibxml2
  • libxml2_13
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do …

• https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
• https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61

---

libxml2

• <2.15.4

Permalink CVE-2026-86139

6.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  7 packages

  • libxml2_13
  • libxml2Python
  • sbclPackages.cl-libxml2
  • perlPackages.AlienLibxml2
  • python313Packages.libxml2
  • python314Packages.libxml2
  • perl5Packages.AlienLibxml2
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer …

• https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
• https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0

---

libxml2

• <2.15.4

Permalink CVE-2026-86141

2.9 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  7 packages

  • libxml2_13
  • libxml2Python
  • sbclPackages.cl-libxml2
  • perlPackages.AlienLibxml2
  • python313Packages.libxml2
  • python314Packages.libxml2
  • perl5Packages.AlienLibxml2
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference …

• https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
• https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55
• https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107

---

libxml2

• <2.15.4

Permalink CVE-2026-86137

2.9 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  7 packages

  • libxml2_13
  • libxml2Python
  • sbclPackages.cl-libxml2
  • perlPackages.AlienLibxml2
  • python313Packages.libxml2
  • python314Packages.libxml2
  • perl5Packages.AlienLibxml2
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka …

• https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
• https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2
• https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1099

---

libxml2

• <2.15.4

Permalink CVE-2026-86140

8.0 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 6 days, 8 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 17 hours ago
• @LeSuisse ignored
  7 packages

  • libxml2_13
  • libxml2Python
  • sbclPackages.cl-libxml2
  • perlPackages.AlienLibxml2
  • python313Packages.libxml2
  • python314Packages.libxml2
  • perl5Packages.AlienLibxml2
  6 days, 8 hours ago
• @LeSuisse accepted 6 days, 8 hours ago
• @LeSuisse published on GitHub 6 days, 8 hours ago

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat …

• https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
• https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340

---

libxml2

• <2.15.4