NIXPKGS-2026-1894

GitHub issue published 3 months ago

Versions of the package degit before 2.8.6, from 3.0.0 and …

Permalink CVE-2026-11572

7.4 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Versions of the package degit before 2.8.6, from 3.0.0 and …

• https://security.snyk.io/vuln/SNYK-JS-DEGIT-17116207
• https://gist.github.com/badp3te/cf22a939eedbd3d8ade9123827d61639 exploit
• https://github.com/Rich-Harris/degit/commit/d55bfd7cea79c0b387f69ec8477b6c34abf…
• https://github.com/Rich-Harris/degit/commit/4ac99e4a4c3f53ca3b5c997bcd7542742ad…

---

degit

• <3.3.1
• <2.8.6

NIXPKGS-2026-1893

GitHub issue published 3 months ago

Logseq security issues in 0.10.15

Permalink CVE-2026-9279

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored reference https://l… 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Shell command injection in Logseq

• https://cert.pl/en/posts/2026/06/CVE-2026-9279/ third-party-advisory

Ignored references (1)

• https://logseq.com/ product

---

logseq

• =<0.10.15

Permalink CVE-2026-47899

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored reference https://l… 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Arbitrary File Read, Write, Rename, and Delete in Logseq

• https://cert.pl/en/posts/2026/06/CVE-2026-9279/ third-party-advisory

Ignored references (1)

• https://logseq.com/ product

---

logseq

• =<0.10.15

Permalink CVE-2026-47901

4.6 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored reference https://l… 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Iframe escape by plugins in Logseq

• https://cert.pl/en/posts/2026/06/CVE-2026-9279/ third-party-advisory

Ignored references (1)

• https://logseq.com/ product

---

logseq

• =<0.10.15

Permalink CVE-2026-47900

4.6 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored reference https://l… 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Stored XSS via Unsanitized Plugin Metadata in Logseq

• https://cert.pl/en/posts/2026/06/CVE-2026-9279/ third-party-advisory

Ignored references (1)

• https://logseq.com/ product

---

logseq

• =<0.10.15

NIXPKGS-2026-1892

GitHub issue published 3 months ago

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

Permalink CVE-2026-11611

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored reference https://r… 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

• https://access.redhat.com/security/cve/CVE-2026-11611 x_refsource_REDHATvdb-entry
• RHBZ#2485424 x_refsource_REDHATissue-tracking

Ignored references (1)

• https://redhat.atlassian.net/browse/PSIRTSUPT-7600

---

389-ds-base

redhat-ds:11/389-ds-base

redhat-ds:12/389-ds-base

NIXPKGS-2026-1891

GitHub issue published 3 months ago

AdGuard Home Authentication Bypass via Path Traversal in Admin-Token Cookie

Permalink CVE-2026-41448

9.2 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • python313Packages.adguardhome
  • python314Packages.adguardhome
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

AdGuard Home Authentication Bypass via Path Traversal in Admin-Token Cookie

• https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.77 release-notes
• https://www.vulncheck.com/advisories/adguard-home-authentication-bypass-via-pat… third-party-advisory

---

AdGuardHome

• <0.107.77

NIXPKGS-2026-1890

GitHub issue published 3 months ago

Neovim View Branch secure.lua M.read command injection

Permalink CVE-2026-11487

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  4 references

  • https://github.com/neovim/neovim/
  • CVE-2026-11487 | CVE Analysis and Report
  • VDB-369107 | CTI Indicators (IOB, IOC, …
  • Submit #834495 | Neovim Neovim <= 0.12…
  3 months ago
• @LeSuisse ignored
  9 packages

  • libvterm-neovim
  • neovim-remote
  • neovim-gtk
  • neovim-qt
  • neovim-qt-unwrapped
  • perlPackages.NeovimExt
  • perl5Packages.NeovimExt
  • vimPlugins.LanguageClient-neovim
  • vscode-extensions.asvetliakov.vscode-neovim
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Neovim View Branch secure.lua M.read command injection

• VDB-369107 | Neovim View Branch secure.lua M.read command injection technical-descriptionvdb-entry
• https://github.com/neovim/neovim/issues/39914 issue-trackingexploit
• https://github.com/neovim/neovim/pull/39918 patchissue-tracking
• https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de94828341b0a1a61a86c75baf patch

Ignored references (4)

• VDB-369107 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• CVE-2026-11487 | CVE Analysis and Report third-party-advisory
• Submit #834495 | Neovim Neovim <= 0.12.2 command injection third-party-advisory
• https://github.com/neovim/neovim/ product

---

Neovim

• ==0.12.0
• ==0.12.2
• ==0.12.1

NIXPKGS-2026-1889

GitHub issue published 3 months ago

YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)

Permalink CVE-2026-52778

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)

• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-px5m-h76g-p7p8 x_refsource_CONFIRM
• https://github.com/YesWiki/yeswiki/commit/dd2bd8fb099de0d21504bda8a810693b3fcb8e52 x_refsource_MISC
• https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6 x_refsource_MISC

---

yeswiki

• ==< 4.6.6

NIXPKGS-2026-1888

GitHub issue published 3 months ago

Weaviate Static API Key client.go validateConfig authorization

Permalink CVE-2026-11500

1.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  4 references

  • https://github.com/weaviate/weaviate/
  • Submit #835080 | weaviate 20f14bed78edd…
  • CVE-2026-11500 | CVE Analysis and Report
  • VDB-369120 | CTI Indicators (IOB, IOC, …
  3 months ago
• @LeSuisse ignored
  2 packages

  • python313Packages.weaviate-client
  • python314Packages.weaviate-client
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Weaviate Static API Key client.go validateConfig authorization

• VDB-369120 | Weaviate Static API Key client.go validateConfig authorization technical-descriptionvdb-entry
• https://github.com/weaviate/weaviate/issues/11392 issue-trackingexploit
• https://github.com/weaviate/weaviate/commit/40f2cc32279f0f8a51016c3c6870a2c0c80… patch
• https://github.com/weaviate/weaviate/releases/tag/v1.38.0-rc.0 patch

Ignored references (4)

• VDB-369120 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-11500 | CVE Analysis and Report third-party-advisory
• Submit #835080 | weaviate 20f14bed78eddac098f84aad97204c0d86ad0c34 Authorization Bypass third-party-advisory
• https://github.com/weaviate/weaviate/ product

---

Weaviate

• ==1.37.7
• ==1.37.4
• ==1.37.5
• ==1.37.2
• ==1.37.1
• ==1.37.3
• ==1.37.6
• ==1.38.0-rc.0
• ==1.37.0

NIXPKGS-2026-1887

GitHub issue published 3 months ago

Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user

Permalink CVE-2026-46484

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored package headplane-agent 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user

• https://github.com/tale/headplane/security/advisories/GHSA-vgj6-hcf2-fqf6 x_refsource_CONFIRM
• https://github.com/tale/headplane/releases/tag/v0.6.3 x_refsource_MISC
• https://github.com/tale/headplane/releases/tag/v0.7.0-beta.3 x_refsource_MISC

---

headplane

• ==< 0.6.3
• ==>= 0.7.0-beta.1, < 0.7.0-beta.3

NIXPKGS-2026-1886

GitHub issue published 3 months ago

Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

Permalink CVE-2026-48507

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

• https://github.com/grokability/snipe-it/security/advisories/GHSA-6f75-x745-xcpr x_refsource_CONFIRM
• https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a x_refsource_MISC

---

snipe-it

• ==< 8.6.0

NIXPKGS-2026-1885

GitHub issue published 3 months ago

OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability …

Permalink CVE-2020-37248

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored reference https://p… 3 months ago
• @LeSuisse ignored maintainer @stephen-huan 3 months ago maintainer.ignore
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability …

• https://github.com/OfflineIMAP/offlineimap3/commit/46505c53ef995455d66c685f9ec3…
• https://github.com/OfflineIMAP/offlineimap3/issues/222
• https://github.com/OfflineIMAP/offlineimap/issues/669
• http://www.openwall.com/lists/oss-security/2026/06/08/3

Ignored references (1)

• https://pypi.org/project/offlineimap/#history

---

OfflineIMAP

• <8.0.3