NIXPKGS-2026-2110

GitHub issue published 5 days, 12 hours ago

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Permalink CVE-2026-55668

6.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse ignored
  3 packages

  • filebrowser-quantum
  • python313Packages.filebrowser-safe
  • python314Packages.filebrowser-safe
  5 days, 12 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8wc8-hf36-mjh9 x_refsource_CONFIRMexploit
• https://github.com/filebrowser/filebrowser/commit/64511ce45e3be379e965f7f4fb0929a068d5bb81 x_refsource_MISC
• https://github.com/filebrowser/filebrowser/releases/tag/v2.63.16 x_refsource_MISC

---

filebrowser

• ==< 2.63.16

NIXPKGS-2026-2111

GitHub issue published 5 days, 12 hours ago

CyberChef: Prototype pollution in Series Chart operation

Permalink CVE-2026-57439

5.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

CyberChef: Prototype pollution in Series Chart operation

• https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c x_refsource_CONFIRMexploit
• https://github.com/gchq/CyberChef/issues/2568 x_refsource_MISC
• https://github.com/gchq/CyberChef/pull/2569 x_refsource_MISC
• https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f x_refsource_MISC
• https://github.com/gchq/CyberChef/releases/tag/v11.2.0 x_refsource_MISC

---

CyberChef

• ==< 11.2.0

NIXPKGS-2026-2109

GitHub issue published 5 days, 12 hours ago

xorg-server / xwayland glamor font atlas Heap Buffer Overflow

Permalink CVE-2026-55999

8.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse ignored
  4 packages

  • xwayland
  • xwayland-run
  • xwayland-satellite
  • gnomeExtensions.xwayland-indicator
  5 days, 12 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

xorg-server / xwayland glamor font atlas Heap Buffer Overflow

• https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742… patch
• https://www.openwall.com/lists/oss-security/2026/07/08/2 vendor-advisory

---

xwayland

• <24.1.13

xorg-server

• <21.1.24

NIXPKGS-2026-2108

GitHub issue published 5 days, 12 hours ago

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

Permalink CVE-2026-55404

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse ignored
  4 packages

  • python313Packages.yt-dlp-ejs
  • python314Packages.yt-dlp-ejs
  • python313Packages.yt-dlp-dearrow
  • python314Packages.yt-dlp-dearrow
  5 days, 12 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32 x_refsource_CONFIRM
• https://github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789 x_refsource_MISC
• https://github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04 x_refsource_MISC

---

yt-dlp

• ==< 2026.7.4

NIXPKGS-2026-2107

GitHub issue published 5 days, 12 hours ago

fluentd: security issues < 1.19.3

Permalink CVE-2026-44161

7.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

• https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr x_refsource_CONFIRM
• https://github.com/fluent/fluentd/pull/5394 x_refsource_MISC
• https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9 x_refsource_MISC
• https://github.com/fluent/fluentd/releases/tag/v1.19.3 x_refsource_MISC

---

fluentd

• ==< 1.19.3

Permalink CVE-2026-44160

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

• https://github.com/fluent/fluentd/security/advisories/GHSA-j9cw-hwqf-85w7 x_refsource_CONFIRM
• https://github.com/fluent/fluentd/pull/5393 x_refsource_MISC
• https://github.com/fluent/fluentd/commit/f5f2b7cddf8aab3932e6dec9fa367a5f3eb27e10 x_refsource_MISC
• https://github.com/fluent/fluentd/releases/tag/v1.19.3 x_refsource_MISC

---

fluentd

• ==< 1.19.3

Permalink CVE-2026-44025

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

Fluentd: Exposure of Sensitive Information via Monitor Agent API

• https://github.com/fluent/fluentd/security/advisories/GHSA-pr7j-96cj-549h x_refsource_CONFIRM
• https://github.com/fluent/fluentd/pull/5392 x_refsource_MISC
• https://github.com/fluent/fluentd/commit/990921518971699b9a97441970674d1800e29177 x_refsource_MISC
• https://github.com/fluent/fluentd/releases/tag/v1.19.3 x_refsource_MISC

---

fluentd

• ==< 1.19.3

Permalink CVE-2026-44024

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

• https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3 x_refsource_CONFIRM
• https://github.com/fluent/fluentd/pull/5391 x_refsource_MISC
• https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437 x_refsource_MISC
• https://github.com/fluent/fluentd/releases/tag/v1.19.3 x_refsource_MISC

---

fluentd

• ==< 1.19.3

NIXPKGS-2026-2106

GitHub issue published 5 days, 12 hours ago

jupyterlab-git: security issues < 0.54.0

Permalink CVE-2026-54528

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

• https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-436q-jwfr-rm2h x_refsource_CONFIRM
• https://github.com/jupyterlab/jupyterlab-git/commit/460035275b5963dc96e364e60ba6a73717fbd033 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0 x_refsource_MISC

---

jupyterlab-git

• ==< 0.54.0

Permalink CVE-2026-54527

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 12 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 12 hours ago
• @LeSuisse published on GitHub 5 days, 12 hours ago

JupyterLab Git: Stored XSS leading to RCE

• https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 x_refsource_CONFIRM
• https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0 x_refsource_MISC

---

jupyterlab-git

• ==>= 0.30.0b3, < 0.54.0

NIXPKGS-2026-2105

GitHub issue published 5 days, 13 hours ago

bbot: security issues < 2.8.6

Permalink CVE-2026-14966

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 days, 13 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse ignored package hebbot 5 days, 13 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 13 hours ago

Symlink guard bypass in unarchive module allows planting symlinks during extraction

• https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b7…

---

BBOT

• =<2.8.6

Permalink CVE-2026-14967

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 days, 13 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse ignored package hebbot 5 days, 13 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 13 hours ago

Path traversal in github_workflows allows writing artifacts outside output directory

• https://github.com/blacklanternsecurity/bbot/commit/c1c6ec05ff998e2fba55a14d102…

---

BBOT

• =<2.8.6

NIXPKGS-2026-2104

GitHub issue published 5 days, 13 hours ago

repomix: security issues < 1.14.1

Permalink CVE-2026-59702

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 13 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 13 hours ago

repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack

• GitHub Iusse exploitissue-tracking
• Product product
• Patch Commit patch
• https://www.vulncheck.com/advisories/repomix-server-side-request-forgery-via-un… third-party-advisory

---

repomix

• <1.14.1
• =<c748b52

Permalink CVE-2026-59703

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 13 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 13 hours ago

repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint

• https://github.com/yamadashy/repomix/issues/1704 exploitissue-tracking
• https://github.com/yamadashy/repomix product
• Patch Commit patch
• https://www.vulncheck.com/advisories/repomix-local-file-inclusion-via-file-url-… third-party-advisory

---

repomix

• <1.14.1
• =<c748b52

NIXPKGS-2026-2103

GitHub issue published 5 days, 13 hours ago

python3Packages.asyncssh: security issues < 2.23.1

Permalink CVE-2026-54590

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 days, 13 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 13 hours ago

AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion

• https://github.com/ronf/asyncssh/security/advisories/GHSA-qr67-gv47-xwwh x_refsource_CONFIRM
• https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88 x_refsource_MISC
• https://github.com/ronf/asyncssh/releases/tag/v2.23.1 x_refsource_MISC

---

asyncssh

• ==< 2.23.1

Permalink CVE-2026-54591

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 days, 13 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 13 hours ago

AsyncSSH: SCP Path Traversal to Arbitrary File Write

• https://github.com/ronf/asyncssh/security/advisories/GHSA-2wxc-x7rj-hg8f x_refsource_CONFIRM
• https://github.com/ronf/asyncssh/commit/d730803b8e4e94c20c7580d90f94d1e05f9f58de x_refsource_MISC
• https://github.com/ronf/asyncssh/releases/tag/v2.23.1 x_refsource_MISC

---

asyncssh

• ==< 2.23.1

NIXPKGS-2026-2102

GitHub issue published 5 days, 13 hours ago

py7zr: CVE-2026-55195 and CVE-2026-55206 (< 1.1.3)

Permalink CVE-2026-55206

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 13 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 13 hours ago

py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

• https://github.com/miurahr/py7zr/security/advisories/GHSA-h4gh-22qq-72r7 x_refsource_CONFIRM
• https://github.com/miurahr/py7zr/commit/d7aa3a197d15c75a65b24f796d3a69f83806d3f8 x_refsource_MISC
• https://github.com/miurahr/py7zr/releases/tag/v1.1.3 x_refsource_MISC

---

py7zr

• ==< 1.1.3

Permalink CVE-2026-55195

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 13 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 19 hours ago
• @LeSuisse accepted 5 days, 13 hours ago
• @LeSuisse published on GitHub 5 days, 13 hours ago

py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size

• https://github.com/miurahr/py7zr/security/advisories/GHSA-gjrg-mpp7-g774 x_refsource_CONFIRM
• https://github.com/miurahr/py7zr/commit/28faf107b64374fa5a02bfb93aa2024e281ca97b x_refsource_MISC
• https://github.com/miurahr/py7zr/releases/tag/v1.1.3 x_refsource_MISC

---

py7zr

• ==< 1.1.3