NIXPKGS-2026-2258

GitHub issue published 4 days, 19 hours ago

pdns-recursor: security issues < 5.4.4

Permalink CVE-2026-52688

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 4 days, 19 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 10 hours ago
• @LeSuisse ignored package rotp 4 days, 19 hours ago
• @LeSuisse accepted 4 days, 19 hours ago
• @LeSuisse published on GitHub 4 days, 19 hours ago

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

---

pdns-recursor

• <5.2.12
• <5.4.4
• <5.3.9

Permalink CVE-2026-52686

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 4 days, 19 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 10 hours ago
• @LeSuisse ignored package rotp 4 days, 19 hours ago
• @LeSuisse accepted 4 days, 19 hours ago
• @LeSuisse published on GitHub 4 days, 19 hours ago

Wildcard CNAME proof validation bypass

• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

---

pdns-recursor

• <5.2.12
• <5.4.4
• <5.3.9

NIXPKGS-2026-2257

GitHub issue published 4 days, 19 hours ago

policycoreutils: security issues < 3.11

Permalink CVE-2026-59677

6.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 days, 19 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 10 hours ago
• @LeSuisse ignored
  11 packages

  • selinux-python
  • libselinux
  • selinux-sandbox
  • selinux-refpolicy
  • selinuxPackages.libselinux
  • python313Packages.libselinux
  • python314Packages.libselinux
  • selinuxPackages.selinux-python
  • selinuxPackages.policycoreutils
  • selinuxPackages.selinux-sandbox
  • selinuxPackages.selinux-refpolicy
  4 days, 19 hours ago
• @LeSuisse accepted 4 days, 19 hours ago
• @LeSuisse published on GitHub 4 days, 19 hours ago

Process Kill Attack Vector in killall() in seunshare

• https://bugzilla.suse.com/show_bug.cgi?id=1268256
• https://security.opensuse.org/2026/07/15/selinux-seunshare.html

---

policycoreutils

• =<3.10

Permalink CVE-2026-59676

5.8 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 days, 19 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 10 hours ago
• @LeSuisse ignored
  11 packages

  • selinux-python
  • libselinux
  • selinux-sandbox
  • selinux-refpolicy
  • selinuxPackages.libselinux
  • python313Packages.libselinux
  • python314Packages.libselinux
  • selinuxPackages.selinux-python
  • selinuxPackages.policycoreutils
  • selinuxPackages.selinux-sandbox
  • selinuxPackages.selinux-refpolicy
  4 days, 19 hours ago
• @LeSuisse accepted 4 days, 19 hours ago
• @LeSuisse published on GitHub 4 days, 19 hours ago

Local File Deletion Attack Vector in rm_rf() in seunshare

• https://bugzilla.suse.com/show_bug.cgi?id=1268256
• https://security.opensuse.org/2026/07/15/selinux-seunshare.html

---

policycoreutils

• =<3.10

NIXPKGS-2026-2256

GitHub issue published 4 days, 19 hours ago

siyuan: security issues < 3.7.2

Permalink CVE-2026-65606

9.4 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 days, 19 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 10 hours ago
• @LeSuisse accepted 4 days, 19 hours ago
• @LeSuisse published on GitHub 4 days, 19 hours ago

SiYuan before v3.7.2 Cross-Site Scripting to RCE

• GitHub Security Advisory (GHSA-wp64-x7qh-h728) exploitvendor-advisory
• https://github.com/siyuan-note/siyuan/commit/41f2861c87575ff5ac4b50a0520b1a4fe55b4a70 patch
• VulnCheck Advisory: SiYuan before v3.7.2 Cross-Site Scripting to RCE third-party-advisory

---

siyuan

• ==3.7.2
• <3.7.2

Permalink CVE-2026-65607

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 days, 19 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 10 hours ago
• @LeSuisse accepted 4 days, 19 hours ago
• @LeSuisse published on GitHub 4 days, 19 hours ago

SiYuan before v3.7.2 Path Traversal via /export/temp/

• GitHub Security Advisory (GHSA-gw25-m53r-qh88) vendor-advisory
• https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7 patch
• VulnCheck Advisory: SiYuan before v3.7.2 Path Traversal via /export/temp/ third-party-advisory

---

siyuan

• ==3.7.2
• <3.7.2

Permalink CVE-2026-65605

9.4 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 days, 19 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 10 hours ago
• @LeSuisse accepted 4 days, 19 hours ago
• @LeSuisse published on GitHub 4 days, 19 hours ago

SiYuan before v3.7.2 Stored XSS to RCE via Attribute View

• GitHub Security Advisory (GHSA-pw5c-qhf3-jhwh) exploitvendor-advisory
• https://github.com/siyuan-note/siyuan/commit/41f2861c87575ff5ac4b50a0520b1a4fe55b4a70 patch
• VulnCheck Advisory: SiYuan before v3.7.2 Stored XSS to RCE via Attribute View third-party-advisory

---

siyuan

• ==3.7.2
• <3.7.2

NIXPKGS-2026-2255

GitHub issue published 4 days, 19 hours ago

libiec61850: security issues < 1.6.2

Permalink CVE-2026-49035

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 days, 19 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 10 hours ago
• @LeSuisse accepted 4 days, 19 hours ago
• @LeSuisse published on GitHub 4 days, 19 hours ago

Stack-based Buffer Overflow in MZ Automation libIEC61850

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06 government-resource

---

libIEC61850

• =<1.6.1

Permalink CVE-2026-50032

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 days, 19 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 10 hours ago
• @LeSuisse accepted 4 days, 19 hours ago
• @LeSuisse published on GitHub 4 days, 19 hours ago

NULL Pointer Dereference in MZ Automation libIEC61850

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06 government-resource

---

libIEC61850

• =<1.6.1

Permalink CVE-2026-50039

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 days, 19 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 10 hours ago
• @LeSuisse accepted 4 days, 19 hours ago
• @LeSuisse published on GitHub 4 days, 19 hours ago

Stack-based Buffer Overflow in MZ Automation libIEC61850

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06 government-resource

---

libIEC61850

• =<1.6.1

Permalink CVE-2026-50103

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 4 days, 19 hours ago by @LeSuisse Activity log

• Created suggestion 5 days, 10 hours ago
• @LeSuisse accepted 4 days, 19 hours ago
• @LeSuisse published on GitHub 4 days, 19 hours ago

Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06 government-resource

---

libIEC61850

• =<1.6.1

NIXPKGS-2026-2254

GitHub issue published 5 days, 17 hours ago

Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting

Permalink CVE-2026-16461

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 days, 17 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 21 hours ago
• @LeSuisse accepted 6 days, 19 hours ago
• @LeSuisse published on GitHub 5 days, 17 hours ago

Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting

• https://access.redhat.com/security/cve/CVE-2026-16461 x_refsource_REDHATvdb-entry
• RHBZ#2502719 issue-trackingx_refsource_REDHAT

---

rpcbind

NIXPKGS-2026-2253

GitHub issue published 5 days, 18 hours ago

Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

Permalink CVE-2026-16445

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 days, 18 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 21 hours ago
• @LeSuisse accepted 6 days, 19 hours ago
• @LeSuisse published on GitHub 5 days, 18 hours ago

Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

• RHSA-2026:26534 x_refsource_REDHATvendor-advisory
• https://access.redhat.com/security/cve/CVE-2026-16445 x_refsource_REDHATvdb-entry
• https://bugzilla.redhat.com/show_bug.cgi?id=2459963
• RHBZ#2503147 issue-trackingx_refsource_REDHAT
• https://github.com/dracutdevs/dracut/commit/e509c638e6

---

dracut

• *

NIXPKGS-2026-2252

GitHub issue published 5 days, 18 hours ago

Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser

Permalink CVE-2026-65315

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 5 days, 18 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 21 hours ago
• @LeSuisse ignored
  16 packages

  • gollama
  • nextjs-ollama-llm-ui
  • python313Packages.ollama
  • python314Packages.ollama
  • python313Packages.llm-ollama
  • python314Packages.llm-ollama
  • haskellPackages.ollama-haskell
  • gnomeExtensions.ollama-indicator
  • python313Packages.langchain-ollama
  • python314Packages.langchain-ollama
  • python313Packages.llama-index-llms-ollama
  • python314Packages.llama-index-llms-ollama
  • python313Packages.llama-index-embeddings-ollama
  • python314Packages.llama-index-embeddings-ollama
  • pkgsRocm.python3Packages.llama-index-llms-ollama
  • pkgsRocm.python3Packages.llama-index-embeddings-ollama
  6 days, 19 hours ago
• @LeSuisse accepted 6 days, 19 hours ago
• @LeSuisse published on GitHub 5 days, 18 hours ago

Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser

• GitHub Issue
• Product patch
• https://www.vulncheck.com/advisories/ollama-remote-denial-of-service-via-attack… third-party-advisory

---

Ollama

• =<f0078ae

Fixed by https://github.com/ollama/ollama/commit/67b6a1c2d45321e0cb3c04a18073f9818de7724b
26.05 needs a backport.

NIXPKGS-2026-2251

GitHub issue published 5 days, 18 hours ago

Capstone has a NULL Pointer Dereference with 3DNow! opcodes

Permalink CVE-2026-47143

5.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 days, 18 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 21 hours ago
• @LeSuisse ignored
  4 packages

  • python314Packages.capstone_4
  • python313Packages.capstone_4
  • python314Packages.capstone
  • python313Packages.capstone
  6 days, 19 hours ago
• @LeSuisse accepted 6 days, 19 hours ago
• @LeSuisse published on GitHub 5 days, 18 hours ago

Capstone has a NULL Pointer Dereference with 3DNow! opcodes

• https://github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrm x_refsource_CONFIRM
• https://github.com/capstone-engine/capstone/pull/2924 x_refsource_MISC
• https://github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1f x_refsource_MISC
• https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7 x_refsource_MISC

---

capstone

• ==< 6.0.0-Alpha8
• ==< 5.0.8

NIXPKGS-2026-2250

GitHub issue published 5 days, 18 hours ago

trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect

Permalink CVE-2026-16336

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): Not Defined (X)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 5 days, 18 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 21 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.trino-python-client
  • python314Packages.trino-python-client
  6 days, 19 hours ago
• @LeSuisse ignored
  4 references

  • https://github.com/trinodb/trino/
  • Submit #858687 | GitHub trino 481 Open …
  • CVE-2026-16336 | CVE Analysis and Report
  • VDB-380710 | CTI Indicators (IOB, IOC, …
  6 days, 19 hours ago
• @LeSuisse accepted 6 days, 19 hours ago
• @LeSuisse published on GitHub 5 days, 18 hours ago

trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect

• VDB-380710 | trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect technical-descriptionvdb-entry
• https://github.com/trinodb/trino/issues/29754 issue-tracking

Ignored references (4)

• https://github.com/trinodb/trino/ product
• Submit #858687 | GitHub trino 481 Open Redirect third-party-advisory
• CVE-2026-16336 | CVE Analysis and Report third-party-advisory
• VDB-380710 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required

---

trino

• ==481

NIXPKGS-2026-2249

GitHub issue published 5 days, 18 hours ago

CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header

Permalink CVE-2026-47667

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 days, 18 hours ago by @LeSuisse Activity log

• Created suggestion 6 days, 21 hours ago
• @LeSuisse accepted 6 days, 19 hours ago
• @LeSuisse published on GitHub 5 days, 18 hours ago

CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header

• https://github.com/GreycLab/CImg/security/advisories/GHSA-rmfc-grgj-qwhv x_refsource_CONFIRM
• https://github.com/GreycLab/CImg/issues/480 x_refsource_MISC
• https://github.com/GreycLab/CImg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee x_refsource_MISC

---

CImg

• ==< 4.0.0