NIXPKGS-2026-1870

GitHub issue published 1 week, 1 day ago

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

          Permalink
          
            CVE-2026-10805
          
        6.7 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          1 week, 1 day ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 2 days ago
          
          @LeSuisse
          
              ignored
            
                20 packages
                networkmanager-ssh
networkmanager_strongswan
networkmanager-fortisslvpn
networkmanager-openconnect
kdePackages.networkmanager-qt
mobile-broadband-provider-info
python313Packages.sdbus-networkmanager
python314Packages.sdbus-networkmanager
haskellPackages.amazonka-networkmanager
python313Packages.mypy-boto3-networkmanager
python314Packages.mypy-boto3-networkmanager
python313Packages.types-aiobotocore-networkmanager
networkmanager-vpnc
networkmanager_dmenu
networkmanager-iodine
networkmanager-openvpn
networkmanager-strongswan
networkmanager-sstp
networkmanagerapplet
networkmanager-l2tp

          1 week, 1 day ago
          
          @LeSuisse
          
              accepted
            
          1 week, 1 day ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 1 day ago
          
            Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend
          
      https://access.redhat.com/security/cve/CVE-2026-10805
    
    vdb-entryx_refsource_REDHAT
  
      RHBZ#2484613
    
    issue-trackingx_refsource_REDHAT
  
    NetworkManager

    networkmanager

    network-manager-applet

    NetworkManager-openswan

    NetworkManager-libreswan

    mobile-broadband-provider-info

    redhat-user-workloads/art-images

    openshift4/ose-ovn-kubernetes-rhel9

    openshift4/kubernetes-nmstate-rhel8-operator

    openshift4/kubernetes-nmstate-rhel9-operator

    openshift4/ose-ovn-kubernetes-microshift-rhel9

    openshift4/ose-kubernetes-nmstate-handler-rhel8

    openshift4/ose-kubernetes-nmstate-handler-rhel9

    openshift4/ose-aws-cluster-api-controllers-rhel8

    openshift4/ose-aws-cluster-api-controllers-rhel9

    multicluster-engine/cluster-api-provider-aws-rhel9

NIXPKGS-2026-1869

GitHub issue published 1 week, 1 day ago

Streamlit Palette hashing.py weak hash

          Permalink
          
            CVE-2026-10804
          
        1.1 LOW
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): High (H)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): Low (L)
        
          Vulnerable System Impact Availability (VA): Low (L)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Exploit Maturity (E): POC (P)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): Low (L)
        
          Modified Vulnerable System Impact Availability (MVA): Low (L)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
              updated
            
          1 week, 1 day ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 2 days ago
          
          @LeSuisse
          
              ignored
            
                4 references
                
                      VDB-368253 | CTI Indicators (IOB, IOC, …
                    
                      CVE-2026-10804 | CVE Analysis and Report
                    
                      Submit #831508 | streamlit 1.53.0 hash …
                    
                      https://github.com/streamlit/streamlit/
                    
          1 week, 1 day ago
          
          @LeSuisse
          
              ignored
            
                14 packages
                python313Packages.streamlit-card
python314Packages.streamlit-card
python313Packages.streamlit-avatar
python313Packages.streamlit-folium
python313Packages.streamlit-notify
python314Packages.streamlit-avatar
python314Packages.streamlit-folium
python314Packages.streamlit-notify
python313Packages.streamlit-echarts
python314Packages.streamlit-echarts
python313Packages.streamlit-kpi-card
python314Packages.streamlit-kpi-card
python313Packages.extra-streamlit-components
python314Packages.extra-streamlit-components

          1 week, 1 day ago
          
          @LeSuisse
          
              accepted
            
          1 week, 1 day ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 1 day ago
          
            Streamlit Palette hashing.py weak hash
          
      VDB-368253 | Streamlit Palette hashing.py weak hash
    
    vdb-entry
  
      https://github.com/streamlit/streamlit/issues/14622
    
    issue-trackingexploit
  
      https://github.com/streamlit/streamlit/pull/14635
    
    issue-trackingpatch
  
          Ignored references (4)
        
      VDB-368253 | CTI Indicators (IOB, IOC, TTP, IOA)
    
    permissions-requiredsignature
  
      CVE-2026-10804 | CVE Analysis and Report
    
    third-party-advisory
  
      Submit #831508 | streamlit 1.53.0 hash collision
    
    third-party-advisory
  
      https://github.com/streamlit/streamlit/
    
    product
  
    Streamlit

            ==1.18
          
            ==1.7
          
            ==1.48
          
            ==1.41
          
            ==1.52
          
            ==1.20
          
            ==1.43
          
            ==1.30
          
            ==1.53.0
          
            ==1.35
          
            ==1.45
          
            ==1.34
          
            ==1.11
          
            ==1.19
          
            ==1.24
          
            ==1.50
          
            ==1.40
          
            ==1.47
          
            ==1.8
          
            ==1.29
          
            ==1.51
          
            ==1.46
          
            ==1.1
          
            ==1.32
          
            ==1.4
          
            ==1.13
          
            ==1.16
          
            ==1.3
          
            ==1.26
          
            ==1.6
          
            ==1.39
          
            ==1.21
          
            ==1.36
          
            ==1.0
          
            ==1.25
          
            ==1.27
          
            ==1.9
          
            ==1.14
          
            ==1.2
          
            ==1.22
          
            ==1.33
          
            ==1.10
          
            ==1.5
          
            ==1.42
          
            ==1.37
          
            ==1.31
          
            ==1.28
          
            ==1.44
          
            ==1.12
          
            ==1.38
          
            ==1.15
          
            ==1.17
          
            ==1.49
          
            ==1.23

NIXPKGS-2026-1868

GitHub issue published 1 week, 1 day ago

ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on …

Permalink CVE-2026-50031

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 3 days ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on …

FreeIPMI

<1.6.18

NIXPKGS-2026-1867

GitHub issue published 1 week, 1 day ago

gradio-app gradio Audio Cache Key save_audio_to_cache weak hash

          Permalink
          
            CVE-2026-10783
          
        1.1 LOW
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): High (H)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): Low (L)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Exploit Maturity (E): POC (P)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
              updated
            
          1 week, 1 day ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 3 days ago
          
          @LeSuisse
          
              ignored
            
                4 references
                
                      VDB-368140 | CTI Indicators (IOB, IOC, …
                    
                      Submit #831451 | gradio-app gradio 6.14…
                    
                      https://github.com/gradio-app/gradio/
                    
                      CVE-2026-10783 | CVE Analysis and Report
                    
          1 week, 1 day ago
          
          @LeSuisse
          
              ignored
            
                7 packages
                python313Packages.gradio-pdf
python314Packages.gradio-pdf
pkgsRocm.python3Packages.gradio
python313Packages.gradio-client
python314Packages.gradio-client
pkgsRocm.python3Packages.gradio-pdf
pkgsRocm.python3Packages.gradio-client

          1 week, 1 day ago
          
          @LeSuisse
          
              accepted
            
          1 week, 1 day ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 1 day ago
          
            gradio-app gradio Audio Cache Key save_audio_to_cache weak hash
          
      VDB-368140 | gradio-app gradio Audio Cache Key save_audio_to_cache weak hash
    
    vdb-entrytechnical-description
  
      https://github.com/gradio-app/gradio/issues/13395
    
    issue-trackingexploit
  
      https://github.com/gradio-app/gradio/pull/13394
    
    issue-trackingpatch
  
          Ignored references (4)
        
      VDB-368140 | CTI Indicators (IOB, IOC, TTP, IOA)
    
    permissions-requiredsignature
  
      Submit #831451 | gradio-app gradio 6.14.0 Cache Poisoning
    
    third-party-advisory
  
      https://github.com/gradio-app/gradio/
    
    product
  
      CVE-2026-10783 | CVE Analysis and Report
    
    third-party-advisory
  
    gradio

            ==6.14.0

NIXPKGS-2026-1866

GitHub issue published 1 week, 1 day ago

Cpanel::JSON::XS security issues before 4.41

Permalink CVE-2026-9516

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 3 days ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws

Cpanel-JSON-XS

<4.41

Permalink CVE-2026-9334

7.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 3 days ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled

Cpanel-JSON-XS

<4.41

NIXPKGS-2026-1865

GitHub issue published 1 week, 1 day ago

Daphne security issues fixed in 4.2.2

Permalink CVE-2026-44545

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 3 days ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service

https://github.com/django/daphne/blob/main/CHANGELOG.txt release-notes

daphne

==4.2.2
=<4.2.1

Permalink CVE-2026-44546

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 3 days ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing

https://github.com/django/daphne/blob/main/CHANGELOG.txt release-notes

daphne

==4.2.2
=<4.2.1

NIXPKGS-2026-1864

GitHub issue published 1 week, 1 day ago

Security issues in rlottie (needs an update)

Permalink CVE-2026-47306

6.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse ignored package libsForQt5.rlottie-qml 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized …

https://github.com/Samsung/rlottie/pull/585

rlottie

==e2d19e3b150e0e4a9586fa90b56fd3061cc98945

Permalink CVE-2026-8916

6.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse ignored package libsForQt5.rlottie-qml 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow …

https://github.com/Samsung/rlottie/pull/589

rlottie

==dcfde72eae1b0464dc0dd760aec00ada6a148635

Permalink CVE-2026-47320

6.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse ignored package libsForQt5.rlottie-qml 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open …

https://github.com/Samsung/rlottie/pull/593

rlottie

==eae37633fda13ac05b25c6c95aacea4bc33c80a3

Permalink CVE-2026-49510

6.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse ignored package libsForQt5.rlottie-qml 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie …

https://github.com/Samsung/rlottie/pull/592

rlottie

==21292665023e5074b38254432716866d00f1985f

Permalink CVE-2026-47319

6.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse ignored package libsForQt5.rlottie-qml 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

Memory allocation with excessive size value vulnerability in Samsung Open …

https://github.com/Samsung/rlottie/pull/588

rlottie

==0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd

Permalink CVE-2026-47318

6.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse ignored package libsForQt5.rlottie-qml 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows …

https://github.com/Samsung/rlottie/pull/582

rlottie

==ce72b35a7ad0dded03051d3aa0ef75321c3bd035

NIXPKGS-2026-1863

GitHub issue published 1 week, 1 day ago

Strawberry GraphQL information leak and DoS

          Permalink
          
            CVE-2026-45739
          
        3.1 LOW
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 week, 1 day ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 2 days ago
          
          @LeSuisse
          
              ignored
            
                3 packages
                python313Packages.strawberry-django
strawberry
pkgsRocm.python3Packages.strawberry-django

          1 week, 1 day ago
          
          @LeSuisse
          
              accepted
            
          1 week, 1 day ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 1 day ago
          
            Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
          
      https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-x97m-qp5c-w9xj
    
    x_refsource_CONFIRM
  
      https://github.com/strawberry-graphql/strawberry/issues/4398
    
    x_refsource_MISC
  
      https://github.com/strawberry-graphql/strawberry/pull/2842
    
    x_refsource_MISC
  
      https://github.com/strawberry-graphql/strawberry/commit/9315ef80a621ae50ca0bc5c82f560ca4ee7e47a9
    
    x_refsource_MISC
  
      https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.4
    
    x_refsource_MISC
  
    strawberry

            ==>= 0.288.4, < 0.315.4

          Permalink
          
            CVE-2026-47706
          
        5.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          1 week, 1 day ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 week, 2 days ago
          
          @LeSuisse
          
              ignored
            
                3 packages
                strawberry
python313Packages.strawberry-django
pkgsRocm.python3Packages.strawberry-django

          1 week, 1 day ago
          
          @LeSuisse
          
              accepted
            
          1 week, 1 day ago
          
          @LeSuisse
          
              published on GitHub
            
          1 week, 1 day ago
          
            Strawberry GraphQL has a Circular Fragment Reference DOS
          
      https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-qfwv-87qj-98xq
    
    x_refsource_CONFIRMexploit
  
      https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7
    
    x_refsource_MISC
  
    strawberry

            ==>= 0.71.0, < 0.315.7

NIXPKGS-2026-1862

GitHub issue published 1 week, 3 days ago

Permalink CVE-2026-10717

1.8 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Attack Requirement (AT): Present (P)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): Low (L)
Safety (S): Negligible (N)
Automatable (AU): Yes (Y)
Recovery (R): Automatic (A)
Value Density (V): Diffuse (D)
Vulnerability Response Effort (RE): Low (L)
Provider Urgency (U): Clear (Clear)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Low (L)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 3 days ago by @LeSuisse Activity log

Created suggestion 1 week, 4 days ago
@LeSuisse accepted 1 week, 3 days ago
@LeSuisse published on GitHub 1 week, 3 days ago

Open-Seachest/Seachest show SCSI Defect List Vulnerability

openSeaChest

=<25.05.3
==26.03.0

NIXPKGS-2026-1861

GitHub issue published 1 week, 3 days ago

Permalink CVE-2026-10718

4.6 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Safety (S): Negligible (N)
Automatable (AU): Yes (Y)
Recovery (R): User (U)
Value Density (V): Diffuse (D)
Vulnerability Response Effort (RE): Low (L)
Provider Urgency (U): Green (Green)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 3 days ago by @LeSuisse Activity log

Created suggestion 1 week, 4 days ago
@LeSuisse accepted 1 week, 3 days ago
@LeSuisse published on GitHub 1 week, 3 days ago

Open Seachest/Seachest NVMe Trim (Deallocate) Vulnerability

openSeaChest

=<26.03.0

Nixpkgs security tracker

Published issues

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

Streamlit Palette hashing.py weak hash

ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on …

gradio-app gradio Audio Cache Key save_audio_to_cache weak hash

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled

Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service

Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized …

Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow …

Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open …

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie …

Memory allocation with excessive size value vulnerability in Samsung Open …

Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows …

Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs

Strawberry GraphQL has a Circular Fragment Reference DOS

Open-Seachest/Seachest show SCSI Defect List Vulnerability

Open Seachest/Seachest NVMe Trim (Deallocate) Vulnerability