Permalink CVE-2026-15165

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Heap-based Buffer Overflow in Wireshark

• https://www.wireshark.org/security/wnpa-sec-2026-56.html
• https://gitlab.com/wireshark/wireshark/-/work_items/21390

---

Wireshark

• <4.6.7

Permalink CVE-2026-15174

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Heap-based Buffer Overflow in Wireshark

• https://www.wireshark.org/security/wnpa-sec-2026-52.html
• https://gitlab.com/wireshark/wireshark/-/work_items/21270

---

Wireshark

• <4.6.7
• <4.4.17

Permalink CVE-2026-15163

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

• https://www.wireshark.org/security/wnpa-sec-2026-61.html
• https://gitlab.com/wireshark/wireshark/-/work_items/21275
• https://gitlab.com/wireshark/wireshark/-/work_items/21277
• https://gitlab.com/wireshark/wireshark/-/work_items/21330
• https://gitlab.com/wireshark/wireshark/-/work_items/21383

---

Wireshark

• <4.6.7
• <4.4.17

Permalink CVE-2026-15169

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Heap-based Buffer Overflow in Wireshark

• https://www.wireshark.org/security/wnpa-sec-2026-59.html
• https://gitlab.com/wireshark/wireshark/-/work_items/21398

---

Wireshark

• <4.6.7
• <4.4.17

Permalink CVE-2026-15166

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Stack-based Buffer Overflow in Wireshark

• https://www.wireshark.org/security/wnpa-sec-2026-57.html
• https://gitlab.com/wireshark/wireshark/-/work_items/21391

---

Wireshark

• <4.6.7
• <4.4.17

Permalink CVE-2026-15172

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Unchecked Input for Loop Condition in Wireshark

• https://www.wireshark.org/security/wnpa-sec-2026-54.html
• https://gitlab.com/wireshark/wireshark/-/work_items/21347

---

Wireshark

• <4.6.7
• <4.4.17

Permalink CVE-2026-15167

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Stack-based Buffer Overflow in Wireshark

• https://www.wireshark.org/security/wnpa-sec-2026-62.html
• https://gitlab.com/wireshark/wireshark/-/work_items/21352

---

Wireshark

• <4.6.7
• <4.4.17

Permalink CVE-2026-15170

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Heap-based Buffer Overflow in Wireshark

• https://www.wireshark.org/security/wnpa-sec-2026-58.html
• https://gitlab.com/wireshark/wireshark/-/work_items/21397

---

Wireshark

• <4.6.7
• <4.4.17

Permalink CVE-2026-15168

2.5 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Use of Uninitialized Variable in Wireshark

• https://www.wireshark.org/security/wnpa-sec-2026-60.html
• https://gitlab.com/wireshark/wireshark/-/work_items/21361

---

Wireshark

• <4.6.7
• <4.4.17

Permalink CVE-2026-15171

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

NULL Pointer Dereference in Wireshark

• https://www.wireshark.org/security/wnpa-sec-2026-55.html
• https://gitlab.com/wireshark/wireshark/-/work_items/21378

---

Wireshark

• <4.6.7
• <4.4.17

Permalink CVE-2026-58207

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

NATS Server: Remote crash via integer overflow in Connz pagination

• https://github.com/nats-io/nats-server/security/advisories/GHSA-q59r-vq66-pxc2 x_refsource_CONFIRM
• https://github.com/nats-io/nats-server/commit/2ae047139e37a38cb01e259a67909e7a39fa38e9 x_refsource_MISC
• https://github.com/nats-io/nats-server/commit/894d9411927681d66ce349bf1afe49608dc0c1a3 x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.12.12 x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.14.3 x_refsource_MISC

---

nats-server

• ==>= 2.14.0-RC.1, < 2.14.3
• ==< 2.12.12

Permalink CVE-2026-58214

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)

• https://github.com/nats-io/nats-server/security/advisories/GHSA-4g68-3pwx-5vfj x_refsource_CONFIRM
• https://github.com/nats-io/nats-server/commit/297b166be60fe13144084eed4b25201ead03204a x_refsource_MISC
• https://github.com/nats-io/nats-server/commit/34b09657bb596d5f850eaa5cfc97ea6b2f989a97 x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.12.12 x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.14.3 x_refsource_MISC

---

nats-server

• ==>= 2.14.0-RC.1, < 2.14.3
• ==< 2.12.12

Permalink CVE-2026-58211

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions

• https://github.com/nats-io/nats-server/security/advisories/GHSA-hmmp-q8cx-v964 x_refsource_CONFIRM

---

nats-server

• ==>= 2.14.0-RC.1, < 2.14.3
• ==< 2.12.12

Permalink CVE-2026-58209

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

NATS Server: MQTT retained and QoS replay bypass subscribe deny filters

• https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg x_refsource_CONFIRM
• https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356 x_refsource_MISC
• https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87 x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.12.12 x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.14.3 x_refsource_MISC

---

nats-server

• ==>= 2.14.0-RC.1, < 2.14.3
• ==< 2.12.12

Permalink CVE-2026-58254

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check

• https://github.com/nats-io/nats-server/security/advisories/GHSA-p3j5-5hrq-p75h x_refsource_CONFIRM
• https://github.com/nats-io/nats-server/commit/cbe845932980b71563efac5cfa4cc751c88936cd x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.12.8 x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.14.3 x_refsource_MISC

---

nats-server

• ==< 2.12.8
• ==>= 2.14.0-RC.1, < 2.14.3

Permalink CVE-2026-58210

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory

• https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg x_refsource_CONFIRM
• https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861 x_refsource_MISC
• https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5 x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.12.12 x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.14.3 x_refsource_MISC

---

nats-server

• ==< 2.12.12
• ==>= 2.14.0-RC.1, < 2.14.3

Permalink CVE-2026-58208

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled

• https://github.com/nats-io/nats-server/security/advisories/GHSA-p957-7v2w-g93g x_refsource_CONFIRM
• https://github.com/nats-io/nats-server/commit/73b3dd9a5ea0fa7bf08b702338676355b29b5fb4 x_refsource_MISC
• https://github.com/nats-io/nats-server/commit/837536b98b3a9280b993282155ff2bdd3ca38c30 x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.12.12 x_refsource_MISC
• https://github.com/nats-io/nats-server/releases/tag/v2.14.3 x_refsource_MISC

---

nats-server

• ==< 2.12.12
• ==>= 2.14.0-RC.1, < 2.14.3

Permalink CVE-2026-59999

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  5 packages

  • opensshTest
  • openssh-askpass
  • perlPackages.NetOpenSSH
  • perl5Packages.NetOpenSSH
  • lxqt.lxqt-openssh-askpass
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to …

• https://www.openwall.com/lists/oss-security/2026/07/06/5
• https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• https://www.openssh.org/releasenotes.html#10.4p1

---

OpenSSH

• <10.4

Permalink CVE-2026-60002

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  5 packages

  • opensshTest
  • openssh-askpass
  • perlPackages.NetOpenSSH
  • perl5Packages.NetOpenSSH
  • lxqt.lxqt-openssh-askpass
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

ssh in OpenSSH before 10.4 can have a use-after-free when …

• https://www.openwall.com/lists/oss-security/2026/07/06/5
• https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• https://www.openssh.org/releasenotes.html#10.4p1

---

OpenSSH

• <10.4

Permalink CVE-2026-59995

4.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  5 packages

  • opensshTest
  • openssh-askpass
  • perlPackages.NetOpenSSH
  • perl5Packages.NetOpenSSH
  • lxqt.lxqt-openssh-askpass
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

sftp in OpenSSH before 10.4 does not properly constrain the …

• https://www.openwall.com/lists/oss-security/2026/07/06/5
• https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• https://www.openssh.org/releasenotes.html#10.4p1

---

OpenSSH

• <10.4

Permalink CVE-2026-59996

4.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  5 packages

  • opensshTest
  • openssh-askpass
  • perlPackages.NetOpenSSH
  • perl5Packages.NetOpenSSH
  • lxqt.lxqt-openssh-askpass
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

scp in OpenSSH before 10.4 may place a file in …

• https://www.openwall.com/lists/oss-security/2026/07/06/5
• https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• https://www.openssh.org/releasenotes.html#10.4p1

---

OpenSSH

• <10.4

Permalink CVE-2026-60001

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  5 packages

  • opensshTest
  • perlPackages.NetOpenSSH
  • perl5Packages.NetOpenSSH
  • lxqt.lxqt-openssh-askpass
  • openssh-askpass
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

sshd in OpenSSH before 10.4 does not always honor the …

• https://www.openwall.com/lists/oss-security/2026/07/06/5
• https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• https://www.openssh.org/releasenotes.html#10.4p1

---

OpenSSH

• <10.4

Permalink CVE-2026-60000

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  5 packages

  • opensshTest
  • lxqt.lxqt-openssh-askpass
  • perl5Packages.NetOpenSSH
  • perlPackages.NetOpenSSH
  • openssh-askpass
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

sshd in OpenSSH before 10.4 allows remote attackers to cause …

• https://www.openwall.com/lists/oss-security/2026/07/06/5
• https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• https://www.openssh.org/releasenotes.html#10.4p1

---

OpenSSH

• <10.4

Permalink CVE-2026-59998

4.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  5 packages

  • opensshTest
  • openssh-askpass
  • perlPackages.NetOpenSSH
  • perl5Packages.NetOpenSSH
  • lxqt.lxqt-openssh-askpass
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: …

• https://www.openwall.com/lists/oss-security/2026/07/06/5
• https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• https://www.openssh.org/releasenotes.html#10.4p1

---

OpenSSH

• <10.4

Permalink CVE-2026-59997

4.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  5 packages

  • lxqt.lxqt-openssh-askpass
  • perl5Packages.NetOpenSSH
  • perlPackages.NetOpenSSH
  • opensshTest
  • openssh-askpass
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the …

• https://www.openwall.com/lists/oss-security/2026/07/06/5
• https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
• https://www.openssh.org/releasenotes.html#10.4p1

---

OpenSSH

• <10.4

Permalink CVE-2026-59253

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

n8n - Improper Authorization in Workflow Assignment to Folders

• GitHub Security Advisory (GHSA-2xgm-wc4g-5jvg) vendor-advisory
• VulnCheck Advisory: n8n - Improper Authorization in Workflow Assignment to Folders third-party-advisory

---

n8n

• <2.28.0
• ==2.28.0

Permalink CVE-2026-58472

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  4 packages

  • wget2
  • wgetpaste
  • python313Packages.wget
  • python314Packages.wget
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding

• Fix Commit patch
• https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-html-att… third-party-advisory

---

wget

• ==dd692d9cea5335b181d877ae917fe6e75587a812
• =<1.25.0

Permalink CVE-2026-58469

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  4 packages

  • wget2
  • wgetpaste
  • python313Packages.wget
  • python314Packages.wget
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing

• Fix Commit patch
• https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-underread-via-metalin… third-party-advisory

---

wget

• ==37a40fcb450153f69537c7cbc2a7a4fb0b6f7826
• =<1.25.0

Permalink CVE-2026-58470

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  4 packages

  • wget2
  • wgetpaste
  • python313Packages.wget
  • python314Packages.wget
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing

• Fix Commit patch
• https://www.vulncheck.com/advisories/gnu-wget-integer-overflow-via-content-rang… third-party-advisory

---

wget

• ==43d3ba9336bc94937e6fae2365c6ffd30c34ffcf
• =<1.25.0

Permalink CVE-2026-58471

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  4 packages

  • wget2
  • wgetpaste
  • python313Packages.wget
  • python314Packages.wget
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c

• Fix Commit patch
• https://www.vulncheck.com/advisories/gnu-wget-heap-buffer-overflow-via-convert-… third-party-advisory

---

wget

• =<1.25.0
• ==c2640fe5171c59f87c58dc9fcb195b2d18b010ee

Permalink CVE-2026-14895

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored reference https://g… 2 months ago
• @LeSuisse ignored
  3 packages

  • chickenPackages_5.chickenEggs.string-utils
  • python314Packages.python-string-utils
  • python313Packages.python-string-utils
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service

• https://github.com/scottchiefbaker/String-Util/commit/f8150867aaeb8f57c59601aef… patch
• https://metacpan.org/release/BAKERSCOT/String-Util-1.36/diff/BAKERSCOT/String-U…

Ignored references (1)

• https://github.com/scottchiefbaker/String-Util/releases release-notes

---

String-Util

• <1.36

Permalink CVE-2026-58384

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  20 packages

  • gimp2
  • gimp3
  • gimp3-with-plugins
  • gimp2Plugins.fourier
  • gimp2Plugins.farbfeld
  • gimpPlugins.lightning
  • gimp2Plugins.lightning
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.texturize
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  • zigimports
  • gimpPlugins.gimp
  • gimpPlugins.gmic
  • gimp-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp2Plugins.gimp
  2 months ago
• @LeSuisse restored package gimp3 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Gimp: gimp: integer overflow in read_rle_channel()

• https://access.redhat.com/security/cve/CVE-2026-58384 x_refsource_REDHATvdb-entry
• RHBZ#2497431 x_refsource_REDHATissue-tracking
• https://gitlab.gnome.org/GNOME/gimp/-/commit/da29e217
• https://gitlab.gnome.org/GNOME/gimp/-/issues/16216

---

gimp

gimp:2.8/gimp

Permalink CVE-2026-55592

3.9 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  8 packages

  • typstPackages.dashy-todo_0_0_2
  • typstPackages.dashy-todo_0_0_1
  • typstPackages.dashy-todo_0_0_3
  • typstPackages.dashy-todo_0_1_0
  • typstPackages.dashy-todo_0_1_1
  • typstPackages.dashy-todo_0_1_2
  • typstPackages.dashy-todo_0_1_3
  • typstPackages.dashy-todo
  2 months ago
• @LeSuisse ignored reference https://g… 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Dashy: XSS in workspace url parameter

• https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc x_refsource_CONFIRM
• https://github.com/lissy93/dashy/commit/4bc620e21cc8e3466f32b8bc40614b0d0eb5648b x_refsource_MISC

Ignored references (1)

• https://github.com/lissy93/dashy/releases/tag/4.3.7 x_refsource_MISC

---

dashy

• ==< 4.3.7

Permalink CVE-2026-53511

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  3 packages

  • calibre-web
  • calibre-no-speech
  • pkgsRocm.calibre-no-speech
  2 months ago
• @LeSuisse ignored reference https://g… 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

calibre: Arbitrary Code Execution in Template Formatter via Book Metadata

• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-2j4m-2q7x-2c47 x_refsource_CONFIRM
• https://github.com/kovidgoyal/calibre/commit/712f4e1ff5c1e798c335bef3bacc4efdee052e9c x_refsource_MISC

Ignored references (1)

• https://github.com/kovidgoyal/calibre/releases/tag/v9.10.0 x_refsource_MISC

---

calibre

• ==< 9.10.0

Permalink CVE-2026-50007

7.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored package gnomeExtensions.maximized-by-default-actually-reborn 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Actual: Shared users can perform owner-only file management actions

• https://github.com/actualbudget/actual/security/advisories/GHSA-23vm-ffgg-qvjr x_refsource_CONFIRM
• https://github.com/actualbudget/actual/pull/7977 x_refsource_MISC
• https://github.com/actualbudget/actual/pull/8333 x_refsource_MISC
• https://github.com/actualbudget/actual/commit/18a8dc03c48eeb2e8252669a80673e6a9933b5fd x_refsource_MISC
• https://github.com/actualbudget/actual/commit/3b9e79ed5ee795a80bbae214d6ebb2755289d7f2 x_refsource_MISC

---

actual

• ==< 26.7.0