NIXPKGS-2026-1578

GitHub issue published 1 month, 1 week ago

          Permalink
          
            CVE-2026-1659
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          1 month, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                44 packages
                gitlab-art
gitlab-duo
gitlab-kas
gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-release-cli
ocamlPackages.gitlab
vimPlugins.gitlab-vim
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl540Packages.AlienBuildPluginDownloadGitLab

          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @globin
@yayayayaka
@krav
@talyz
@leona-ya

          1 month, 1 week ago
          
              maintainer.ignore
            
          @LeSuisse
          
              ignored
            
              reference HackerOne…
            
          1 month, 1 week ago
          
          @LeSuisse
          
              accepted
            
          1 month, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          1 month, 1 week ago
          
            Allocation of Resources Without Limits or Throttling in GitLab
          
      https://gitlab.com/gitlab-org/gitlab/-/work_items/588201
    
      https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-relea…
    
          Ignored references (1)
        
      HackerOne Bug Bounty Report #3519824
    
    technical-descriptionpermissions-requiredexploit
  
    GitLab

            <18.11.3
          
            <18.10.6
          
            <18.9.7

NIXPKGS-2026-1577

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-42283

7.7 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
3 packages
- python312Packages.azure-mgmt-devspaces
- python313Packages.azure-mgmt-devspaces
- python314Packages.azure-mgmt-devspaces
1 month, 1 week ago
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

DevSpace UI Server WebSocket CheckOrigin does not validate source

https://github.com/devspace-sh/devspace/security/advisories/GHSA-hqwm-7x7x-8379 x_refsource_CONFIRM

devspace

==< 6.3.21

NIXPKGS-2026-1576

GitHub issue published 1 month, 1 week ago

          Permalink
          
            CVE-2026-3607
          
        4.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 month, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
              reference HackerOne…
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                44 packages
                gitlab-art
gitlab-duo
gitlab-kas
gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-release-cli
ocamlPackages.gitlab
vimPlugins.gitlab-vim
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl540Packages.AlienBuildPluginDownloadGitLab

          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @talyz
@leona-ya
@krav
@globin
@yayayayaka

          1 month, 1 week ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          1 month, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          1 month, 1 week ago
          
            Access Control Check Implemented After Asset is Accessed in GitLab
          
      https://gitlab.com/gitlab-org/gitlab/-/work_items/592466
    
      https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-relea…
    
          Ignored references (1)
        
      HackerOne Bug Bounty Report #3586233
    
    technical-descriptionpermissions-requiredexploit
  
    GitLab

            <18.11.3
          
            <18.10.6
          
            <18.9.7

NIXPKGS-2026-1575

GitHub issue published 1 month, 1 week ago

          Permalink
          
            CVE-2026-1322
          
        6.8 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 month, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
              package gitlab-art
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
              reference HackerOne…
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                43 packages
                gitlab-duo
gitlab-kas
gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-release-cli
ocamlPackages.gitlab
vimPlugins.gitlab-vim
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl540Packages.AlienBuildPluginDownloadGitLab

          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @globin
@yayayayaka
@krav
@leona-ya
@talyz

          1 month, 1 week ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          1 month, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          1 month, 1 week ago
          
            Business Logic Errors in GitLab
          
      https://gitlab.com/gitlab-org/gitlab/-/work_items/587270
    
      https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-relea…
    
          Ignored references (1)
        
      HackerOne Bug Bounty Report #3508895
    
    technical-descriptionpermissions-requiredexploit
  
    GitLab

            <18.11.3
          
            <18.10.6
          
            <18.9.7

NIXPKGS-2026-1574

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-43906

8.5 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
4 packages
- colmap
- colmapWithCuda
- python313Packages.openimageio
- python314Packages.openimageio
1 month, 1 week ago
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

OpenImageIO: HEIF Heap overflow

https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-gmrp-x952-3m66 x_refsource_CONFIRM

OpenImageIO

==< 3.0.18.0
==>= 3.1.4.0-beta, < 3.1.13.0

NIXPKGS-2026-1573

GitHub issue published 1 month, 1 week ago

          Permalink
          
            CVE-2026-4527
          
        6.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 month, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                2 packages
                gitlab-art
gitlab-duo

          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
              reference HackerOne…
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                42 packages
                gitlab-kas
gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-release-cli
ocamlPackages.gitlab
vimPlugins.gitlab-vim
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl540Packages.AlienBuildPluginDownloadGitLab

          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @talyz
@leona-ya
@krav
@yayayayaka
@globin

          1 month, 1 week ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          1 month, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          1 month, 1 week ago
          
            Cross-Site Request Forgery (CSRF) in GitLab
          
      https://gitlab.com/gitlab-org/gitlab/-/work_items/594339
    
      https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-relea…
    
          Ignored references (1)
        
      HackerOne Bug Bounty Report #3590487
    
    technical-descriptionpermissions-requiredexploit
  
    GitLab

            <18.11.3
          
            <18.10.6
          
            <18.9.7

NIXPKGS-2026-1572

GitHub issue published 1 month, 1 week ago

          Permalink
          
            CVE-2026-3073
          
        4.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 month, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
              reference HackerOne…
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                44 packages
                gitlab-art
gitlab-duo
gitlab-kas
gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-release-cli
ocamlPackages.gitlab
vimPlugins.gitlab-vim
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl540Packages.AlienBuildPluginDownloadGitLab

          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @talyz
@leona-ya
@krav
@globin
@yayayayaka

          1 month, 1 week ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          1 month, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          1 month, 1 week ago
          
            Authorization Bypass Through User-Controlled Key in GitLab
          
      https://gitlab.com/gitlab-org/gitlab/-/work_items/591227
    
      https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-relea…
    
          Ignored references (1)
        
      HackerOne Bug Bounty Report #3532563
    
    technical-descriptionpermissions-requiredexploit
  
    GitLab

            <18.11.3
          
            <18.10.6
          
            <18.9.7

NIXPKGS-2026-1571

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-43903

8.4 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
4 packages
- colmap
- colmapWithCuda
- python313Packages.openimageio
- python314Packages.openimageio
1 month, 1 week ago
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

OpenImageIO: SGI RLE decoder heap buffer overflow OIIO_DASSERT bounds checks are no-ops in release builds

https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-jg3q-vm3q-2j35 x_refsource_CONFIRMexploit

OpenImageIO

==< 3.0.18.0
==>= 3.1.4.0-beta, < 3.1.13.0

NIXPKGS-2026-1570

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-42592

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
3 packages
- python312Packages.gotenberg-client
- python313Packages.gotenberg-client
- python314Packages.gotenberg-client
1 month, 1 week ago
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2pmr-289p-44r3 x_refsource_CONFIRMexploit

gotenberg

==< 8.32.0

NIXPKGS-2026-1569

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-43904

8.4 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
4 packages
- colmap
- colmapWithCuda
- python313Packages.openimageio
- python314Packages.openimageio
1 month, 1 week ago
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width

https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-4499-j545-7q33 x_refsource_CONFIRM

OpenImageIO

==< 3.0.18.0
==>= 3.1.4.0-beta, < 3.1.13.0

Nixpkgs security tracker

Published issues

Allocation of Resources Without Limits or Throttling in GitLab

DevSpace UI Server WebSocket CheckOrigin does not validate source

Access Control Check Implemented After Asset is Accessed in GitLab

Business Logic Errors in GitLab

OpenImageIO: HEIF Heap overflow

Cross-Site Request Forgery (CSRF) in GitLab

Authorization Bypass Through User-Controlled Key in GitLab

OpenImageIO: SGI RLE decoder heap buffer overflow OIIO_DASSERT bounds checks are no-ops in release builds

Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes

OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width