NIXPKGS-2026-1994

GitHub issue published 2 months, 2 weeks ago

pnpm: security issues < 11.5.3, < 10.34.2

Permalink CVE-2026-55487

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
4 packages
- pnpmBuildHook
- pnpmConfigHook
- pnpm-fixup-state-db
- pnpm-shell-completion
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

https://github.com/pnpm/pnpm/security/advisories/GHSA-5wx6-mg75-v57r exploitx_refsource_CONFIRM

pnpm

==>= 11.0.0, < 11.5.3
==< 10.34.2

Needs some backports and bumps for the 10.x branch

Permalink CVE-2026-55700

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
8 packages
- pnpm_8
- pnpm_9
- pnpm_10
- pnpm_10_29_2
- pnpmBuildHook
- pnpmConfigHook
- pnpm-fixup-state-db
- pnpm-shell-completion
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

pnpm: stage download writes outside destination via manifest version traversal

https://github.com/pnpm/pnpm/security/advisories/GHSA-v23m-ccfg-pq9h x_refsource_CONFIRM
https://github.com/pnpm/pnpm/pull/12303 x_refsource_MISC

pnpm

==>= 11.3.0, < 11.5.3

Needs some backports

Permalink CVE-2026-55698

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
4 packages
- pnpmBuildHook
- pnpmConfigHook
- pnpm-fixup-state-db
- pnpm-shell-completion
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

https://github.com/pnpm/pnpm/security/advisories/GHSA-w466-c33r-3gjp x_refsource_CONFIRM

pnpm

==>= 11.0.0, < 11.5.3
==< 10.34.2

Needs some backports and bumps for the 10.x branch

Permalink CVE-2026-55180

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
4 packages
- pnpm-fixup-state-db
- pnpm-shell-completion
- pnpmConfigHook
- pnpmBuildHook
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r exploitx_refsource_CONFIRM

pnpm

==>= 11.0.0, < 11.5.3
==< 10.34.2

Needs some backports and bumps for the 10.x branch

Permalink CVE-2026-55697

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
5 packages
- pnpm_10_29_2
- pnpmBuildHook
- pnpmConfigHook
- pnpm-fixup-state-db
- pnpm-shell-completion
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

https://github.com/pnpm/pnpm/security/advisories/GHSA-gj8w-mvpf-x27x x_refsource_CONFIRM

pnpm

==>= 11.0.0, < 11.5.3
==< 10.34.2

Needs some backports and bumps for the 10.x branch

NIXPKGS-2026-1993

GitHub issue published 2 months, 2 weeks ago

pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field

Permalink CVE-2026-50021

6.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
8 packages
- pnpm
- pnpm_8
- pnpm_9
- pnpm_11
- pnpmBuildHook
- pnpmConfigHook
- pnpm-fixup-state-db
- pnpm-shell-completion
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field

https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3 x_refsource_CONFIRM

pnpm

==>= 11.0.0, < 11.4.0
==< 10.34.0

Needs some backports

NIXPKGS-2026-1992

GitHub issue published 2 months, 2 weeks ago

pdns-recursor: security issues < 5.4.3

Permalink CVE-2026-42389

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored package rotp 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Reject more queries with invalid header values

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.4.3

Permalink CVE-2026-33612

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored package rotp 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

ZoneToCache can poison the cache

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.2.11
<5.3.8
<5.4.3

Permalink CVE-2026-40012

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse ignored package rotp 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Information about ECS zero scoped answers might leak to clients that use a specific ECS

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.4.3
<5.3.8
<5.2.11

Permalink CVE-2026-42387

5.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored package rotp 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Insufficient input validation in ZoneToCache

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.4.3
<5.3.8
<5.2.11

Permalink CVE-2026-42388

5.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored package rotp 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Missing input validation for catalog zones

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.2.11
<5.3.8
<5.4.3

Permalink CVE-2026-42390

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored package rotp 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

ZONEMD validation can be bypassed

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.4.3

Permalink CVE-2026-52690

5.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored package rotp 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Spoofed answers can mark an authoritative non-EDNS capable

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.4.3
<5.3.8
<5.2.11

NIXPKGS-2026-1991

GitHub issue published 2 months, 2 weeks ago

Insufficient input validation of internal web server

Permalink CVE-2026-42005

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
4 packages
- home-assistant-component-tests.namecheapdns
- pdns-recursor
- pdnsgrep
- pdnsd
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Insufficient input validation of internal web server

https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-p…

pdns

<4.9.16
<5.1.2
<5.0.6

NIXPKGS-2026-1990

GitHub issue published 2 months, 2 weeks ago

dnsdist: security issues < 2.0.7

Permalink CVE-2026-40210

4.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Out-of-bounds read in SetMacAddrAction

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

dnsdist

<2.0.7
<1.9.15

Permalink CVE-2026-40209

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Denial of service via IXFR queries

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

dnsdist

<1.9.15
<2.0.7

Permalink CVE-2026-40208

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Denial of service via DoH3 queries

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

dnsdist

<2.0.7
<1.9.15

Permalink CVE-2026-42004

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

EDNS options smuggling

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

dnsdist

<2.0.7
<1.9.15

Permalink CVE-2026-40211

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Denial of service via crafted DoH3 queries

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

dnsdist

<2.0.7
<1.9.15

Permalink CVE-2026-40011

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Prometheus denial of service via crafted DNS queries

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

dnsdist

<2.0.7
<1.9.15

NIXPKGS-2026-1989

GitHub issue published 2 months, 2 weeks ago

nsd: security issues < 4.14.3

Permalink CVE-2026-12246

7.2 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
20 packages
- pdnsd
- dnsdbq
- nsdiff
- dnsdiag
- dnsdist
- zeronsd
- adidnsdump
- perlPackages.nsdiff
- perl5Packages.nsdiff
- perl538Packages.nsdiff
- perl540Packages.nsdiff
- idrisPackages.transducers
- python312Packages.webexpythonsdk
- python313Packages.webexpythonsdk
- python314Packages.webexpythonsdk
- python312Packages.awsiotpythonsdk
- python313Packages.awsiotpythonsdk
- python314Packages.awsiotpythonsdk
- vscode-extensions.nsd.vscode-epics
- chickenPackages_5.chickenEggs.transducers
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Out of bounds stack write with crafted APL RR

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt vendor-advisory

NSD

<4.14.3

Permalink CVE-2026-12244

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
20 packages
- pdnsd
- dnsdbq
- nsdiff
- dnsdiag
- dnsdist
- zeronsd
- adidnsdump
- perlPackages.nsdiff
- perl5Packages.nsdiff
- perl538Packages.nsdiff
- perl540Packages.nsdiff
- idrisPackages.transducers
- python312Packages.webexpythonsdk
- python313Packages.webexpythonsdk
- python314Packages.webexpythonsdk
- python312Packages.awsiotpythonsdk
- python313Packages.awsiotpythonsdk
- python314Packages.awsiotpythonsdk
- chickenPackages_5.chickenEggs.transducers
- vscode-extensions.nsd.vscode-epics
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Heap overflow and crash with crafted SVCB RR

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt vendor-advisory

NSD

<4.14.3

Permalink CVE-2026-12490

8.2 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
20 packages
- pdnsd
- dnsdbq
- nsdiff
- dnsdiag
- dnsdist
- zeronsd
- adidnsdump
- perlPackages.nsdiff
- perl5Packages.nsdiff
- perl538Packages.nsdiff
- perl540Packages.nsdiff
- idrisPackages.transducers
- python312Packages.webexpythonsdk
- python313Packages.webexpythonsdk
- python314Packages.webexpythonsdk
- python312Packages.awsiotpythonsdk
- python313Packages.awsiotpythonsdk
- python314Packages.awsiotpythonsdk
- vscode-extensions.nsd.vscode-epics
- chickenPackages_5.chickenEggs.transducers
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Bypass of client certificate verification with transfer over TLS

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt vendor-advisory

NSD

<4.14.3

Permalink CVE-2026-12245

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
20 packages
- pdnsd
- dnsdbq
- nsdiff
- dnsdiag
- dnsdist
- zeronsd
- adidnsdump
- perlPackages.nsdiff
- perl5Packages.nsdiff
- perl538Packages.nsdiff
- perl540Packages.nsdiff
- idrisPackages.transducers
- python312Packages.webexpythonsdk
- python313Packages.webexpythonsdk
- python314Packages.webexpythonsdk
- python312Packages.awsiotpythonsdk
- python313Packages.awsiotpythonsdk
- python314Packages.awsiotpythonsdk
- vscode-extensions.nsd.vscode-epics
- chickenPackages_5.chickenEggs.transducers
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Denial of DNS over TLS service by any DoT client

https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt vendor-advisory

NSD

<4.14.3

NIXPKGS-2026-1988

GitHub issue published 2 months, 2 weeks ago

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

Permalink CVE-2026-55667

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
4 packages
- filebrowser-quantum
- python312Packages.filebrowser-safe
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8jhr x_refsource_CONFIRM

filebrowser

==< 2.63.16

NIXPKGS-2026-1987

GitHub issue published 2 months, 2 weeks ago

filebrowser: security issues < 2.63.14

          Permalink
          
            CVE-2026-54092
          
        6.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          2 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 months, 2 weeks ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                filebrowser-quantum
python312Packages.filebrowser-safe
python313Packages.filebrowser-safe
python314Packages.filebrowser-safe

          2 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          2 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          2 months, 2 weeks ago
          
            File Browser: DoS Vulnerability on Public Login API
          
      https://github.com/filebrowser/filebrowser/security/advisories/GHSA-w5fm-68j4-fpc4
    
    x_refsource_CONFIRM
  
      https://github.com/filebrowser/filebrowser/commit/847d08bdd135e5c3659f2e6dea2f0cd36617af9b
    
    x_refsource_MISC
  
      https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6
    
    x_refsource_MISC
  
    filebrowser

            ==< 2.63.6
          
            Needs a backport

Permalink CVE-2026-54096

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
4 packages
- filebrowser-quantum
- python312Packages.filebrowser-safe
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2p-72cj-682c x_refsource_CONFIRMexploit

filebrowser

==< 2.63.7

Needs a backport

          Permalink
          
            CVE-2026-54097
          
        7.2 HIGH
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): High (H)
        
          Vulnerable System Impact Availability (VA): High (H)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): High (H)
        
          Modified Vulnerable System Impact Availability (MVA): High (H)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          2 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 months, 2 weeks ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                filebrowser-quantum
python312Packages.filebrowser-safe
python313Packages.filebrowser-safe
python314Packages.filebrowser-safe

          2 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          2 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          2 months, 2 weeks ago
          
            File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix
          
      https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5ww9-jg6q-38r7
    
    exploitx_refsource_CONFIRM
  
      https://github.com/filebrowser/filebrowser/commit/0231b7ebdfbe77a6c54027d30c4856c3fd81ee4d
    
    x_refsource_MISC
  
      https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6
    
    x_refsource_MISC
  
    filebrowser

            ==< 2.63.6
          
            Needs a backport

Permalink CVE-2026-54093

6.8 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
4 packages
- filebrowser-quantum
- python312Packages.filebrowser-safe
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-gxjx-7m74-hcq8 x_refsource_CONFIRMexploit

filebrowser

==< 2.63.6

Needs a backport

          Permalink
          
            CVE-2026-54091
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          2 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 months, 2 weeks ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                filebrowser-quantum
python312Packages.filebrowser-safe
python313Packages.filebrowser-safe
python314Packages.filebrowser-safe

          2 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          2 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          2 months, 2 weeks ago
          
            File Browser: Incorrect access control in public directory shares via rule path rebasing
          
      https://github.com/filebrowser/filebrowser/security/advisories/GHSA-j9jx-hp4c-ghhh
    
    x_refsource_CONFIRM
  
      https://github.com/filebrowser/filebrowser/commit/e07c59df0b850f5924d5b1683e8609661ddcf534
    
    x_refsource_MISC
  
      https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6
    
    x_refsource_MISC
  
    filebrowser

            ==< 2.63.6
          
            Needs a backport

Permalink CVE-2026-54094

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
4 packages
- filebrowser-quantum
- python312Packages.filebrowser-safe
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-239w-m3h6-ch8v x_refsource_CONFIRMexploit

filebrowser

==< 2.63.14

Needs a backport

Permalink CVE-2026-54088

9.3 CRITICAL

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
4 packages
- filebrowser-quantum
- python312Packages.filebrowser-safe
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm x_refsource_CONFIRMexploit

filebrowser

==< 2.63.6

Needs a backport

NIXPKGS-2026-1986

GitHub issue published 2 months, 3 weeks ago

OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser

          Permalink
          
            CVE-2026-42450
          
        8.4 HIGH
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Active (A)
        
          Vulnerable System Impact Confidentiality (VC): High (H)
        
          Vulnerable System Impact Integrity (VI): High (H)
        
          Vulnerable System Impact Availability (VA): High (H)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Active (A)
        
          Modified Vulnerable System Impact Confidentiality (MVC): High (H)
        
          Modified Vulnerable System Impact Integrity (MVI): High (H)
        
          Modified Vulnerable System Impact Availability (MVA): High (H)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          2 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              package opencolorio_1
            
          2 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          2 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          2 months, 3 weeks ago
          
            OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser
          
      https://github.com/AcademySoftwareFoundation/OpenColorIO/security/advisories/GHSA-rxp3-rrgx-f547
    
    x_refsource_CONFIRMexploit
  
      https://github.com/AcademySoftwareFoundation/OpenColorIO/releases/tag/v2.5.2
    
    x_refsource_MISC
  
    OpenColorIO

            ==< 2.5.2

NIXPKGS-2026-1985

GitHub issue published 2 months, 3 weeks ago

motionEye: World-Readable Configuration File Exposes Admin Password Hash

Permalink CVE-2026-32315

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 2 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 3 weeks ago
@LeSuisse ignored
4 packages
- python312Packages.motioneye-client
- python313Packages.motioneye-client
- home-assistant-component-tests.motioneye
- python314Packages.motioneye-client
2 months, 3 weeks ago
@LeSuisse accepted 2 months, 3 weeks ago
@LeSuisse published on GitHub 2 months, 3 weeks ago

motionEye: World-Readable Configuration File Exposes Admin Password Hash

https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rhgp-6wq6-9j67 x_refsource_CONFIRM
https://github.com/motioneye-project/motioneye/releases/tag/0.44.0 x_refsource_MISC

motioneye

==< 0.44.0

Nixpkgs security tracker

Published issues

pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

pnpm: stage download writes outside destination via manifest version traversal

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field

Reject more queries with invalid header values

ZoneToCache can poison the cache

Information about ECS zero scoped answers might leak to clients that use a specific ECS

Insufficient input validation in ZoneToCache

Missing input validation for catalog zones

ZONEMD validation can be bypassed

Spoofed answers can mark an authoritative non-EDNS capable

Insufficient input validation of internal web server

Out-of-bounds read in SetMacAddrAction

Denial of service via IXFR queries

Denial of service via DoH3 queries

EDNS options smuggling

Denial of service via crafted DoH3 queries

Prometheus denial of service via crafted DNS queries

Out of bounds stack write with crafted APL RR

Heap overflow and crash with crafted SVCB RR

Bypass of client certificate verification with transfer over TLS

Denial of DNS over TLS service by any DoT client

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

File Browser: DoS Vulnerability on Public Login API

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix

File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames

File Browser: Incorrect access control in public directory shares via rule path rebasing

File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser

motionEye: World-Readable Configuration File Exposes Admin Password Hash