NIXPKGS-2026-2108

GitHub issue published 2 months ago

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

Permalink CVE-2026-55404

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  4 packages

  • python313Packages.yt-dlp-ejs
  • python314Packages.yt-dlp-ejs
  • python313Packages.yt-dlp-dearrow
  • python314Packages.yt-dlp-dearrow
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32 x_refsource_CONFIRM
• https://github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789 x_refsource_MISC
• https://github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04 x_refsource_MISC

---

yt-dlp

• ==< 2026.7.4

NIXPKGS-2026-2107

GitHub issue published 2 months ago

fluentd: security issues < 1.19.3

Permalink CVE-2026-44161

7.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

• https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr x_refsource_CONFIRM
• https://github.com/fluent/fluentd/pull/5394 x_refsource_MISC
• https://github.com/fluent/fluentd/commit/c6a01ea2e0ea01977f8d615f7c6dbfae4cba88c9 x_refsource_MISC
• https://github.com/fluent/fluentd/releases/tag/v1.19.3 x_refsource_MISC

---

fluentd

• ==< 1.19.3

Permalink CVE-2026-44160

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

• https://github.com/fluent/fluentd/security/advisories/GHSA-j9cw-hwqf-85w7 x_refsource_CONFIRM
• https://github.com/fluent/fluentd/pull/5393 x_refsource_MISC
• https://github.com/fluent/fluentd/commit/f5f2b7cddf8aab3932e6dec9fa367a5f3eb27e10 x_refsource_MISC
• https://github.com/fluent/fluentd/releases/tag/v1.19.3 x_refsource_MISC

---

fluentd

• ==< 1.19.3

Permalink CVE-2026-44025

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Fluentd: Exposure of Sensitive Information via Monitor Agent API

• https://github.com/fluent/fluentd/security/advisories/GHSA-pr7j-96cj-549h x_refsource_CONFIRM
• https://github.com/fluent/fluentd/pull/5392 x_refsource_MISC
• https://github.com/fluent/fluentd/commit/990921518971699b9a97441970674d1800e29177 x_refsource_MISC
• https://github.com/fluent/fluentd/releases/tag/v1.19.3 x_refsource_MISC

---

fluentd

• ==< 1.19.3

Permalink CVE-2026-44024

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

• https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3 x_refsource_CONFIRM
• https://github.com/fluent/fluentd/pull/5391 x_refsource_MISC
• https://github.com/fluent/fluentd/commit/45c87a81f3ac0b72b3f9dcfe8cfb5f9038f81437 x_refsource_MISC
• https://github.com/fluent/fluentd/releases/tag/v1.19.3 x_refsource_MISC

---

fluentd

• ==< 1.19.3

NIXPKGS-2026-2106

GitHub issue published 2 months ago

jupyterlab-git: security issues < 0.54.0

Permalink CVE-2026-54528

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

• https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-436q-jwfr-rm2h x_refsource_CONFIRM
• https://github.com/jupyterlab/jupyterlab-git/commit/460035275b5963dc96e364e60ba6a73717fbd033 x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0 x_refsource_MISC

---

jupyterlab-git

• ==< 0.54.0

Permalink CVE-2026-54527

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

JupyterLab Git: Stored XSS leading to RCE

• https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 x_refsource_CONFIRM
• https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b x_refsource_MISC
• https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0 x_refsource_MISC

---

jupyterlab-git

• ==>= 0.30.0b3, < 0.54.0

NIXPKGS-2026-2105

GitHub issue published 2 months ago

bbot: security issues < 2.8.6

Permalink CVE-2026-14966

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored package hebbot 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Symlink guard bypass in unarchive module allows planting symlinks during extraction

• https://github.com/blacklanternsecurity/bbot/commit/a3f1a2292e2b0a553827c6175b7…

---

BBOT

• =<2.8.6

Permalink CVE-2026-14967

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored package hebbot 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Path traversal in github_workflows allows writing artifacts outside output directory

• https://github.com/blacklanternsecurity/bbot/commit/c1c6ec05ff998e2fba55a14d102…

---

BBOT

• =<2.8.6

NIXPKGS-2026-2104

GitHub issue published 2 months ago

repomix: security issues < 1.14.1

Permalink CVE-2026-59702

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack

• GitHub Iusse issue-trackingexploit
• Product product
• Patch Commit patch
• https://www.vulncheck.com/advisories/repomix-server-side-request-forgery-via-un… third-party-advisory

---

repomix

• =<c748b52
• <1.14.1

Permalink CVE-2026-59703

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint

• https://github.com/yamadashy/repomix/issues/1704 issue-trackingexploit
• https://github.com/yamadashy/repomix product
• Patch Commit patch
• https://www.vulncheck.com/advisories/repomix-local-file-inclusion-via-file-url-… third-party-advisory

---

repomix

• =<c748b52
• <1.14.1

NIXPKGS-2026-2103

GitHub issue published 2 months ago

python3Packages.asyncssh: security issues < 2.23.1

Permalink CVE-2026-54590

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion

• https://github.com/ronf/asyncssh/security/advisories/GHSA-qr67-gv47-xwwh x_refsource_CONFIRM
• https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88 x_refsource_MISC
• https://github.com/ronf/asyncssh/releases/tag/v2.23.1 x_refsource_MISC

---

asyncssh

• ==< 2.23.1

Permalink CVE-2026-54591

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

AsyncSSH: SCP Path Traversal to Arbitrary File Write

• https://github.com/ronf/asyncssh/security/advisories/GHSA-2wxc-x7rj-hg8f x_refsource_CONFIRM
• https://github.com/ronf/asyncssh/commit/d730803b8e4e94c20c7580d90f94d1e05f9f58de x_refsource_MISC
• https://github.com/ronf/asyncssh/releases/tag/v2.23.1 x_refsource_MISC

---

asyncssh

• ==< 2.23.1

NIXPKGS-2026-2102

GitHub issue published 2 months ago

py7zr: CVE-2026-55195 and CVE-2026-55206 (< 1.1.3)

Permalink CVE-2026-55206

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

• https://github.com/miurahr/py7zr/security/advisories/GHSA-h4gh-22qq-72r7 x_refsource_CONFIRM
• https://github.com/miurahr/py7zr/commit/d7aa3a197d15c75a65b24f796d3a69f83806d3f8 x_refsource_MISC
• https://github.com/miurahr/py7zr/releases/tag/v1.1.3 x_refsource_MISC

---

py7zr

• ==< 1.1.3

Permalink CVE-2026-55195

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size

• https://github.com/miurahr/py7zr/security/advisories/GHSA-gjrg-mpp7-g774 x_refsource_CONFIRM
• https://github.com/miurahr/py7zr/commit/28faf107b64374fa5a02bfb93aa2024e281ca97b x_refsource_MISC
• https://github.com/miurahr/py7zr/releases/tag/v1.1.3 x_refsource_MISC

---

py7zr

• ==< 1.1.3

NIXPKGS-2026-2101

GitHub issue published 2 months ago

seaweedfs: security issues < 4.34

Permalink CVE-2026-55874

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4 x_refsource_CONFIRM
• https://github.com/seaweedfs/seaweedfs/pull/9929 x_refsource_MISC
• https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd x_refsource_MISC
• https://github.com/seaweedfs/seaweedfs/releases/tag/4.34 x_refsource_MISC

---

seaweedfs

• ==< 4.34

Permalink CVE-2026-55873

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets

• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hgpf-8634-g44c x_refsource_CONFIRM
• https://github.com/seaweedfs/seaweedfs/pull/9961 x_refsource_MISC
• https://github.com/seaweedfs/seaweedfs/commit/b13463880c1fa62e255c058a9228b63cc95b4b36 x_refsource_MISC
• https://github.com/seaweedfs/seaweedfs/releases/tag/4.34 x_refsource_MISC

---

seaweedfs

• ==>= 4.08, < 4.34

Permalink CVE-2026-58372

7.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys

• Release Notes release-notes
• Fix PR relatedissue-tracking
• Fix Commit patch
• Prior advisory (CVE-2026-54917) - incompletely fixed exploit
• Researcher Disclosure technical-descriptionexploit
• https://www.vulncheck.com/advisories/seaweedfs-cross-bucket-object-deletion-via… third-party-advisory

---

seaweedfs

• <4.34

NIXPKGS-2026-2100

GitHub issue published 2 months ago

GitLab: security issues < 18.11.7

Permalink CVE-2026-13320

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): High (H)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  39 packages

  • gitlab-art
  • gitlab-duo
  • gitlab-kas
  • gitlab-ci-ls
  • gitlab-pages
  • gitlab-shell
  • danger-gitlab
  • gitlab-clippy
  • gitlab-runner
  • gitlab-triage
  • gitlab-ci-local
  • gitlab-timelogs
  • gitlab-ci-linter
  • gitlab-workhorse
  • gitlab-release-cli
  • ocamlPackages.gitlab
  • gitlab-container-registry
  • ocamlPackages.gitlab-jsoo
  • ocamlPackages.gitlab-unix
  • rubyPackages.gitlab-markup
  • terraform-providers.gitlab
  • ocamlPackages_latest.gitlab
  • gitlab-elasticsearch-indexer
  • haskellPackages.gitlab-haskell
  • rubyPackages_3_3.gitlab-markup
  • rubyPackages_3_4.gitlab-markup
  • rubyPackages_4_0.gitlab-markup
  • python313Packages.mkdocs-gitlab
  • python313Packages.python-gitlab
  • python314Packages.mkdocs-gitlab
  • python314Packages.python-gitlab
  • ocamlPackages_latest.gitlab-jsoo
  • ocamlPackages_latest.gitlab-unix
  • terraform-providers.gitlabhq_gitlab
  • gnomeExtensions.gitlab-time-tracking
  • prometheus-gitlab-ci-pipelines-exporter
  • vscode-extensions.gitlab.gitlab-workflow
  • perlPackages.AlienBuildPluginDownloadGitLab
  • perl5Packages.AlienBuildPluginDownloadGitLab
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

• https://gitlab.com/gitlab-org/gitlab/-/work_items/604063
• HackerOne Bug Bounty Report #3816917 permissions-requiredtechnical-descriptionexploit
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/

---

GitLab

• <19.1.2
• <19.0.4
• <18.11.7

Permalink CVE-2025-12506

3.5 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  39 packages

  • gitlab-art
  • gitlab-duo
  • gitlab-kas
  • gitlab-ci-ls
  • gitlab-pages
  • gitlab-shell
  • danger-gitlab
  • gitlab-clippy
  • gitlab-runner
  • gitlab-triage
  • gitlab-ci-local
  • gitlab-timelogs
  • gitlab-ci-linter
  • gitlab-workhorse
  • gitlab-release-cli
  • ocamlPackages.gitlab
  • gitlab-container-registry
  • ocamlPackages.gitlab-jsoo
  • ocamlPackages.gitlab-unix
  • rubyPackages.gitlab-markup
  • terraform-providers.gitlab
  • ocamlPackages_latest.gitlab
  • gitlab-elasticsearch-indexer
  • haskellPackages.gitlab-haskell
  • rubyPackages_3_3.gitlab-markup
  • rubyPackages_3_4.gitlab-markup
  • rubyPackages_4_0.gitlab-markup
  • python313Packages.mkdocs-gitlab
  • python313Packages.python-gitlab
  • python314Packages.mkdocs-gitlab
  • python314Packages.python-gitlab
  • ocamlPackages_latest.gitlab-jsoo
  • ocamlPackages_latest.gitlab-unix
  • terraform-providers.gitlabhq_gitlab
  • gnomeExtensions.gitlab-time-tracking
  • prometheus-gitlab-ci-pipelines-exporter
  • vscode-extensions.gitlab.gitlab-workflow
  • perlPackages.AlienBuildPluginDownloadGitLab
  • perl5Packages.AlienBuildPluginDownloadGitLab
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Use of Incorrectly-Resolved Name or Reference in GitLab

• HackerOne Bug Bounty Report #3351460 permissions-requiredtechnical-descriptionexploit
• https://gitlab.com/gitlab-org/gitlab/-/work_items/578988
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/

---

GitLab

• <19.1.2
• <19.0.4
• <18.11.7

Permalink CVE-2026-13151

2.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  39 packages

  • gitlab-art
  • gitlab-duo
  • gitlab-kas
  • gitlab-ci-ls
  • gitlab-pages
  • gitlab-shell
  • danger-gitlab
  • gitlab-clippy
  • gitlab-runner
  • gitlab-triage
  • gitlab-ci-local
  • gitlab-timelogs
  • gitlab-ci-linter
  • gitlab-workhorse
  • gitlab-release-cli
  • ocamlPackages.gitlab
  • gitlab-container-registry
  • ocamlPackages.gitlab-jsoo
  • ocamlPackages.gitlab-unix
  • rubyPackages.gitlab-markup
  • terraform-providers.gitlab
  • ocamlPackages_latest.gitlab
  • gitlab-elasticsearch-indexer
  • haskellPackages.gitlab-haskell
  • rubyPackages_3_3.gitlab-markup
  • rubyPackages_3_4.gitlab-markup
  • rubyPackages_4_0.gitlab-markup
  • python313Packages.mkdocs-gitlab
  • python313Packages.python-gitlab
  • python314Packages.mkdocs-gitlab
  • python314Packages.python-gitlab
  • ocamlPackages_latest.gitlab-jsoo
  • ocamlPackages_latest.gitlab-unix
  • terraform-providers.gitlabhq_gitlab
  • gnomeExtensions.gitlab-time-tracking
  • prometheus-gitlab-ci-pipelines-exporter
  • vscode-extensions.gitlab.gitlab-workflow
  • perlPackages.AlienBuildPluginDownloadGitLab
  • perl5Packages.AlienBuildPluginDownloadGitLab
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Incorrect Authorization in GitLab

• https://gitlab.com/gitlab-org/gitlab/-/work_items/598813
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/

---

GitLab

• <19.1.2
• <19.0.4
• <18.11.7

Permalink CVE-2026-8472

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  39 packages

  • gitlab-art
  • gitlab-duo
  • gitlab-kas
  • gitlab-ci-ls
  • gitlab-pages
  • gitlab-shell
  • danger-gitlab
  • gitlab-clippy
  • gitlab-runner
  • gitlab-triage
  • gitlab-ci-local
  • gitlab-timelogs
  • gitlab-ci-linter
  • gitlab-workhorse
  • gitlab-release-cli
  • ocamlPackages.gitlab
  • gitlab-container-registry
  • ocamlPackages.gitlab-jsoo
  • ocamlPackages.gitlab-unix
  • rubyPackages.gitlab-markup
  • terraform-providers.gitlab
  • ocamlPackages_latest.gitlab
  • gitlab-elasticsearch-indexer
  • haskellPackages.gitlab-haskell
  • rubyPackages_3_3.gitlab-markup
  • rubyPackages_3_4.gitlab-markup
  • rubyPackages_4_0.gitlab-markup
  • python313Packages.mkdocs-gitlab
  • python313Packages.python-gitlab
  • python314Packages.mkdocs-gitlab
  • python314Packages.python-gitlab
  • ocamlPackages_latest.gitlab-jsoo
  • ocamlPackages_latest.gitlab-unix
  • terraform-providers.gitlabhq_gitlab
  • gnomeExtensions.gitlab-time-tracking
  • prometheus-gitlab-ci-pipelines-exporter
  • vscode-extensions.gitlab.gitlab-workflow
  • perlPackages.AlienBuildPluginDownloadGitLab
  • perl5Packages.AlienBuildPluginDownloadGitLab
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Missing Authorization in GitLab

• https://gitlab.com/gitlab-org/gitlab/-/work_items/599987
• HackerOne Bug Bounty Report #3615282 permissions-requiredtechnical-descriptionexploit
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/

---

GitLab

• <19.1.2
• <19.0.4
• <18.11.7

Permalink CVE-2026-11827

4.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  39 packages

  • gitlab-art
  • gitlab-duo
  • gitlab-kas
  • gitlab-ci-ls
  • gitlab-pages
  • gitlab-shell
  • danger-gitlab
  • gitlab-clippy
  • gitlab-runner
  • gitlab-triage
  • gitlab-ci-local
  • gitlab-timelogs
  • gitlab-ci-linter
  • gitlab-workhorse
  • gitlab-release-cli
  • ocamlPackages.gitlab
  • gitlab-container-registry
  • ocamlPackages.gitlab-jsoo
  • ocamlPackages.gitlab-unix
  • rubyPackages.gitlab-markup
  • terraform-providers.gitlab
  • ocamlPackages_latest.gitlab
  • gitlab-elasticsearch-indexer
  • haskellPackages.gitlab-haskell
  • rubyPackages_3_3.gitlab-markup
  • rubyPackages_3_4.gitlab-markup
  • rubyPackages_4_0.gitlab-markup
  • python313Packages.mkdocs-gitlab
  • python313Packages.python-gitlab
  • python314Packages.mkdocs-gitlab
  • python314Packages.python-gitlab
  • ocamlPackages_latest.gitlab-jsoo
  • ocamlPackages_latest.gitlab-unix
  • terraform-providers.gitlabhq_gitlab
  • gnomeExtensions.gitlab-time-tracking
  • prometheus-gitlab-ci-pipelines-exporter
  • vscode-extensions.gitlab.gitlab-workflow
  • perlPackages.AlienBuildPluginDownloadGitLab
  • perl5Packages.AlienBuildPluginDownloadGitLab
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Insufficiently Protected Credentials in GitLab

• https://gitlab.com/gitlab-org/gitlab/-/work_items/602478
• HackerOne Bug Bounty Report #3720483 permissions-requiredtechnical-descriptionexploit
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/

---

GitLab

• <19.1.2
• <19.0.4
• <18.11.7

Permalink CVE-2026-7492

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  39 packages

  • gitlab-art
  • gitlab-duo
  • gitlab-kas
  • gitlab-ci-ls
  • gitlab-pages
  • gitlab-shell
  • danger-gitlab
  • gitlab-clippy
  • gitlab-runner
  • gitlab-triage
  • gitlab-ci-local
  • gitlab-timelogs
  • gitlab-ci-linter
  • gitlab-workhorse
  • gitlab-release-cli
  • ocamlPackages.gitlab
  • gitlab-container-registry
  • ocamlPackages.gitlab-jsoo
  • ocamlPackages.gitlab-unix
  • rubyPackages.gitlab-markup
  • terraform-providers.gitlab
  • ocamlPackages_latest.gitlab
  • gitlab-elasticsearch-indexer
  • haskellPackages.gitlab-haskell
  • rubyPackages_3_3.gitlab-markup
  • rubyPackages_3_4.gitlab-markup
  • rubyPackages_4_0.gitlab-markup
  • python313Packages.mkdocs-gitlab
  • python313Packages.python-gitlab
  • python314Packages.mkdocs-gitlab
  • python314Packages.python-gitlab
  • ocamlPackages_latest.gitlab-jsoo
  • ocamlPackages_latest.gitlab-unix
  • terraform-providers.gitlabhq_gitlab
  • gnomeExtensions.gitlab-time-tracking
  • prometheus-gitlab-ci-pipelines-exporter
  • vscode-extensions.gitlab.gitlab-workflow
  • perlPackages.AlienBuildPluginDownloadGitLab
  • perl5Packages.AlienBuildPluginDownloadGitLab
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Missing Authorization in GitLab

• HackerOne Bug Bounty Report #3704739 permissions-requiredtechnical-descriptionexploit
• https://gitlab.com/gitlab-org/gitlab/-/work_items/597947
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/

---

GitLab

• <19.1.2
• <19.0.4
• <18.11.7

Permalink CVE-2026-6896

8.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  39 packages

  • gitlab-art
  • gitlab-duo
  • gitlab-kas
  • gitlab-ci-ls
  • gitlab-pages
  • gitlab-shell
  • danger-gitlab
  • gitlab-clippy
  • gitlab-runner
  • gitlab-triage
  • gitlab-ci-local
  • gitlab-timelogs
  • gitlab-ci-linter
  • gitlab-workhorse
  • gitlab-release-cli
  • ocamlPackages.gitlab
  • gitlab-container-registry
  • ocamlPackages.gitlab-jsoo
  • ocamlPackages.gitlab-unix
  • rubyPackages.gitlab-markup
  • terraform-providers.gitlab
  • ocamlPackages_latest.gitlab
  • gitlab-elasticsearch-indexer
  • haskellPackages.gitlab-haskell
  • rubyPackages_3_3.gitlab-markup
  • rubyPackages_3_4.gitlab-markup
  • rubyPackages_4_0.gitlab-markup
  • python313Packages.mkdocs-gitlab
  • python313Packages.python-gitlab
  • python314Packages.mkdocs-gitlab
  • python314Packages.python-gitlab
  • ocamlPackages_latest.gitlab-jsoo
  • ocamlPackages_latest.gitlab-unix
  • terraform-providers.gitlabhq_gitlab
  • gnomeExtensions.gitlab-time-tracking
  • prometheus-gitlab-ci-pipelines-exporter
  • vscode-extensions.gitlab.gitlab-workflow
  • perlPackages.AlienBuildPluginDownloadGitLab
  • perl5Packages.AlienBuildPluginDownloadGitLab
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

• https://gitlab.com/gitlab-org/gitlab/-/work_items/597887
• HackerOne Bug Bounty Report #3682085 permissions-requiredtechnical-descriptionexploit
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/

---

GitLab

• <19.1.2
• <19.0.4
• <18.11.7

Permalink CVE-2026-6352

2.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  39 packages

  • gitlab-duo
  • gitlab-kas
  • gitlab-ci-ls
  • gitlab-pages
  • gitlab-shell
  • danger-gitlab
  • gitlab-clippy
  • gitlab-runner
  • gitlab-triage
  • gitlab-ci-local
  • gitlab-timelogs
  • gitlab-ci-linter
  • gitlab-workhorse
  • gitlab-release-cli
  • ocamlPackages.gitlab
  • gitlab-container-registry
  • ocamlPackages.gitlab-jsoo
  • ocamlPackages.gitlab-unix
  • rubyPackages.gitlab-markup
  • terraform-providers.gitlab
  • ocamlPackages_latest.gitlab
  • gitlab-elasticsearch-indexer
  • haskellPackages.gitlab-haskell
  • rubyPackages_3_3.gitlab-markup
  • rubyPackages_3_4.gitlab-markup
  • rubyPackages_4_0.gitlab-markup
  • python313Packages.mkdocs-gitlab
  • python313Packages.python-gitlab
  • python314Packages.mkdocs-gitlab
  • python314Packages.python-gitlab
  • ocamlPackages_latest.gitlab-jsoo
  • ocamlPackages_latest.gitlab-unix
  • terraform-providers.gitlabhq_gitlab
  • gnomeExtensions.gitlab-time-tracking
  • prometheus-gitlab-ci-pipelines-exporter
  • vscode-extensions.gitlab.gitlab-workflow
  • perlPackages.AlienBuildPluginDownloadGitLab
  • perl5Packages.AlienBuildPluginDownloadGitLab
  • gitlab-art
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Incorrect Authorization in GitLab

• https://gitlab.com/gitlab-org/gitlab/-/work_items/596789
• HackerOne Bug Bounty Report #3631344 permissions-requiredtechnical-descriptionexploit
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/

---

GitLab

• <19.1.2
• <19.0.4
• <18.11.7

NIXPKGS-2026-2099

GitHub issue published 2 months ago

phpPackages.composer: security issues < 2.10.2

Permalink CVE-2026-59947

4.7 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  13 packages

  • subtitlecomposer
  • composer-require-checker
  • haskellPackages.gogol-composer
  • phpPackages.cyclonedx-php-composer
  • php82Packages.cyclonedx-php-composer
  • php83Packages.cyclonedx-php-composer
  • php84Packages.cyclonedx-php-composer
  • php85Packages.cyclonedx-php-composer
  • phpPackages.composer-local-repo-plugin
  • php82Packages.composer-local-repo-plugin
  • php83Packages.composer-local-repo-plugin
  • php84Packages.composer-local-repo-plugin
  • php85Packages.composer-local-repo-plugin
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

• https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3 x_refsource_CONFIRM
• https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8 x_refsource_MISC
• https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec x_refsource_MISC
• https://github.com/composer/composer/releases/tag/2.10.2 x_refsource_MISC
• https://github.com/composer/composer/releases/tag/2.2.29 x_refsource_MISC

---

composer

• ==>= 2.3.0, < 2.10.2
• ==>= 1.0, < 2.2.29

Permalink CVE-2026-59948

7.0 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  13 packages

  • subtitlecomposer
  • composer-require-checker
  • haskellPackages.gogol-composer
  • phpPackages.cyclonedx-php-composer
  • php82Packages.cyclonedx-php-composer
  • php83Packages.cyclonedx-php-composer
  • php84Packages.cyclonedx-php-composer
  • php85Packages.cyclonedx-php-composer
  • phpPackages.composer-local-repo-plugin
  • php82Packages.composer-local-repo-plugin
  • php83Packages.composer-local-repo-plugin
  • php84Packages.composer-local-repo-plugin
  • php85Packages.composer-local-repo-plugin
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Composer: Arbitrary file write outside vendor via malicious transitive package name

• https://github.com/composer/composer/security/advisories/GHSA-499r-g7pc-vmp9 x_refsource_CONFIRM
• https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0 x_refsource_MISC
• https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1 x_refsource_MISC
• https://github.com/composer/composer/releases/tag/2.10.2 x_refsource_MISC
• https://github.com/composer/composer/releases/tag/2.2.29 x_refsource_MISC

---

composer

• ==>= 2.3.0, < 2.10.2
• ==>= 1.0, < 2.2.29

Permalink CVE-2026-59946

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  13 packages

  • subtitlecomposer
  • composer-require-checker
  • haskellPackages.gogol-composer
  • phpPackages.cyclonedx-php-composer
  • php82Packages.cyclonedx-php-composer
  • php83Packages.cyclonedx-php-composer
  • php84Packages.cyclonedx-php-composer
  • php85Packages.cyclonedx-php-composer
  • phpPackages.composer-local-repo-plugin
  • php82Packages.composer-local-repo-plugin
  • php83Packages.composer-local-repo-plugin
  • php84Packages.composer-local-repo-plugin
  • php85Packages.composer-local-repo-plugin
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

• https://github.com/composer/composer/security/advisories/GHSA-gjfg-22fp-rrxx x_refsource_CONFIRM
• https://github.com/composer/composer/commit/502c6c4f699802d9cf464728b3e8a95674f919a0 x_refsource_MISC
• https://github.com/composer/composer/commit/c50b1efd13ebd73f6dca19b31424c5a02bf93cc1 x_refsource_MISC
• https://github.com/composer/composer/releases/tag/2.10.2 x_refsource_MISC
• https://github.com/composer/composer/releases/tag/2.2.29 x_refsource_MISC

---

composer

• ==>= 2.3.0, < 2.10.2
• ==>= 1.0, < 2.2.29