NIXPKGS-2026-1568

GitHub issue published 1 month, 1 week ago

          Permalink
          
            CVE-2025-13874
          
        4.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 month, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                45 packages
                gitlab-art
gitlab-duo
gitlab-kas
gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-release-cli
ocamlPackages.gitlab
vimPlugins.gitlab-vim
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
gitlab-ee
perl540Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab

          1 month, 1 week ago
          
          @LeSuisse
          
              restored
            
              package gitlab-ee
            
          1 month, 1 week ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @talyz
@leona-ya
@yayayayaka
@krav
@globin

          1 month, 1 week ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          1 month, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          1 month, 1 week ago
          
            Authorization Bypass Through User-Controlled Key in GitLab
          
      HackerOne Bug Bounty Report #3445398
    
    technical-descriptionpermissions-requiredexploit
  
      https://gitlab.com/gitlab-org/gitlab/-/work_items/582634
    
      https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-relea…
    
    GitLab

            <18.11.3
          
            <18.10.6
          
            <18.9.7

NIXPKGS-2026-1567

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-43996

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
4 packages
- colmap
- colmapWithCuda
- python313Packages.openimageio
- python314Packages.openimageio
1 month, 1 week ago
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

OpenImageIO: Integer wraparound in bounds check of decode_pixel leads to out-of-bounds read in TGA paletted image decoder

https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-mq8j-73c4-cr55 x_refsource_CONFIRM

OpenImageIO

==< 3.0.18.0
==>= 3.1.4.0-beta, < 3.1.13.0

NIXPKGS-2026-1566

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-46446

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and …

SOGo

<5.12.7

NIXPKGS-2026-1565

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-46445

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.

SOGo

<5.12.7

NIXPKGS-2026-1564

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-7471

3.5 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
44 packages
- gitlab-art
- gitlab-duo
- gitlab-kas
- gitlab-ci-ls
- gitlab-pages
- gitlab-shell
- danger-gitlab
- gitlab-clippy
- gitlab-runner
- gitlab-triage
- gitlab-ci-local
- gitlab-timelogs
- gitlab-ci-linter
- gitlab-workhorse
- gitlab-release-cli
- ocamlPackages.gitlab
- vimPlugins.gitlab-vim
- gitlab-container-registry
- ocamlPackages.gitlab-jsoo
- ocamlPackages.gitlab-unix
- rubyPackages.gitlab-markup
- terraform-providers.gitlab
- ocamlPackages_latest.gitlab
- gitlab-elasticsearch-indexer
- haskellPackages.gitlab-haskell
- rubyPackages_3_3.gitlab-markup
- rubyPackages_3_4.gitlab-markup
- rubyPackages_4_0.gitlab-markup
- python312Packages.mkdocs-gitlab
- python312Packages.python-gitlab
- python313Packages.mkdocs-gitlab
- python313Packages.python-gitlab
- python314Packages.mkdocs-gitlab
- python314Packages.python-gitlab
- ocamlPackages_latest.gitlab-jsoo
- ocamlPackages_latest.gitlab-unix
- terraform-providers.gitlabhq_gitlab
- gnomeExtensions.gitlab-time-tracking
- prometheus-gitlab-ci-pipelines-exporter
- vscode-extensions.gitlab.gitlab-workflow
- perlPackages.AlienBuildPluginDownloadGitLab
- perl5Packages.AlienBuildPluginDownloadGitLab
- perl538Packages.AlienBuildPluginDownloadGitLab
- perl540Packages.AlienBuildPluginDownloadGitLab
1 month, 1 week ago
@LeSuisse ignored
5 maintainers
- @globin
- @krav
- @yayayayaka
- @leona-ya
- @talyz
1 month, 1 week ago maintainer.ignore
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

Server-Side Request Forgery (SSRF) in GitLab

GitLab

<18.11.3
<18.10.6
<18.9.7

NIXPKGS-2026-1563

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-43909

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
4 packages
- colmap
- colmapWithCuda
- python313Packages.openimageio
- python314Packages.openimageio
1 month, 1 week ago
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder

https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-g267-j53j-5258 x_refsource_CONFIRMexploit

OpenImageIO

==< 3.0.18.0
==>= 3.1.4.0-beta, < 3.1.13.0

NIXPKGS-2026-1562

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-24000

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
19 packages
- azure-cli-extensions.fleet
- python312Packages.tesla-fleet-api
- python313Packages.tesla-fleet-api
- python314Packages.tesla-fleet-api
- haskellPackages.amazonka-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python312Packages.mypy-boto3-iotfleethub
- python313Packages.mypy-boto3-iotfleethub
- python314Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleetwise
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleetwise
- home-assistant-component-tests.tesla_fleet
- python312Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleethub
- python312Packages.types-aiobotocore-iotfleetwise
- python313Packages.types-aiobotocore-iotfleetwise
- fleetctl
- fleeting-plugin-aws
1 month, 1 week ago
@LeSuisse ignored
2 maintainers
- @LeSuisse
- @asauzeau
1 month, 1 week ago maintainer.ignore
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

Fleet has a rate limiting bypass via untrusted client IP headers

https://github.com/fleetdm/fleet/security/advisories/GHSA-j8h8-75h3-jg53 x_refsource_CONFIRM
https://github.com/fleetdm/fleet/releases/tag/fleet-v4.80.1 x_refsource_MISC

fleet

==< 4.80.1

NIXPKGS-2026-1561

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-26062

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
19 packages
- fleetctl
- python312Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleethub
- python312Packages.types-aiobotocore-iotfleetwise
- python313Packages.types-aiobotocore-iotfleetwise
- home-assistant-component-tests.tesla_fleet
- python314Packages.mypy-boto3-iotfleetwise
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python314Packages.tesla-fleet-api
- python313Packages.tesla-fleet-api
- python312Packages.tesla-fleet-api
- azure-cli-extensions.fleet
- fleeting-plugin-aws
- haskellPackages.amazonka-iotfleethub
- python313Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleetwise
1 month, 1 week ago
@LeSuisse ignored
2 maintainers
- @LeSuisse
- @asauzeau
1 month, 1 week ago maintainer.ignore
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

Fleet server may terminate unexpectedly when handling certain gRPC requests

https://github.com/fleetdm/fleet/security/advisories/GHSA-x67p-9m2r-fxqv x_refsource_CONFIRM
https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.0 x_refsource_MISC

fleet

==< 4.81.0

NIXPKGS-2026-1560

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-23998

8.2 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
19 packages
- fleetctl
- python312Packages.tesla-fleet-api
- python313Packages.tesla-fleet-api
- python314Packages.tesla-fleet-api
- haskellPackages.amazonka-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python312Packages.mypy-boto3-iotfleethub
- python313Packages.mypy-boto3-iotfleethub
- python314Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleetwise
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleetwise
- home-assistant-component-tests.tesla_fleet
- python312Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleethub
- python312Packages.types-aiobotocore-iotfleetwise
- python313Packages.types-aiobotocore-iotfleetwise
- azure-cli-extensions.fleet
- fleeting-plugin-aws
1 month, 1 week ago
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

Fleet has a Windows MDM management endpoint authentication bypass

https://github.com/fleetdm/fleet/security/advisories/GHSA-2rc4-7jc6-qffh x_refsource_CONFIRM
https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.0 x_refsource_MISC

fleet

==< 4.81.0

NIXPKGS-2026-1559

GitHub issue published 1 month, 1 week ago

Permalink CVE-2026-26191

6.0 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 month, 1 week ago by @LeSuisse Activity log

Created suggestion 1 month, 1 week ago
@LeSuisse ignored
19 packages
- fleeting-plugin-aws
- azure-cli-extensions.fleet
- python312Packages.tesla-fleet-api
- python313Packages.tesla-fleet-api
- python314Packages.tesla-fleet-api
- haskellPackages.amazonka-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python312Packages.mypy-boto3-iotfleethub
- python313Packages.mypy-boto3-iotfleethub
- python314Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleetwise
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleetwise
- home-assistant-component-tests.tesla_fleet
- python312Packages.types-aiobotocore-iotfleethub
- fleetctl
- python313Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleetwise
- python312Packages.types-aiobotocore-iotfleetwise
1 month, 1 week ago
@LeSuisse ignored
2 maintainers
- @LeSuisse
- @asauzeau
1 month, 1 week ago maintainer.ignore
@LeSuisse accepted 1 month, 1 week ago
@LeSuisse published on GitHub 1 month, 1 week ago

Fleet vulnerable to OS command injection in software packages

https://github.com/fleetdm/fleet/security/advisories/GHSA-9vcr-g537-3w5v x_refsource_CONFIRM
https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.1 x_refsource_MISC

fleet

==< 4.81.1

Nixpkgs security tracker

Published issues

Authorization Bypass Through User-Controlled Key in GitLab

OpenImageIO: Integer wraparound in bounds check of decode_pixel leads to out-of-bounds read in TGA paletted image decoder

SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and …

SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.

Server-Side Request Forgery (SSRF) in GitLab

OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder

Fleet has a rate limiting bypass via untrusted client IP headers

Fleet server may terminate unexpectedly when handling certain gRPC requests

Fleet has a Windows MDM management endpoint authentication bypass

Fleet vulnerable to OS command injection in software packages