NIXPKGS-2026-1264

GitHub issue published 1 month, 4 weeks ago

Permalink CVE-2026-41492

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 month, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  5 packages

  • coqPackages.dpdgraph
  • perlPackages.GDGraph
  • perl5Packages.GDGraph
  • perl538Packages.GDGraph
  • perl540Packages.GDGraph
  1 month, 4 weeks ago
• @LeSuisse accepted 1 month, 4 weeks ago
• @LeSuisse published on GitHub 1 month, 4 weeks ago

Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q x_refsource_CONFIRMexploit
• https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3 x_refsource_MISC

---

dgraph

• ==< 25.3.3

NIXPKGS-2026-1266

GitHub issue published 1 month, 4 weeks ago

Permalink CVE-2026-40690

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 1 month, 4 weeks ago
• @LeSuisse published on GitHub 1 month, 4 weeks ago

Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users

• https://github.com/apache/airflow/pull/65273 patch
• https://lists.apache.org/thread/bqt7y4g2cpj396b0sd20lv510ff19ndl vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/04/24/4

---

apache-airflow

• <3.2.1

NIXPKGS-2026-1262

GitHub issue published 1 month, 4 weeks ago

Permalink CVE-2026-41481

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 1 month, 4 weeks ago
• @LeSuisse published on GitHub 1 month, 4 weeks ago

LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

• https://github.com/langchain-ai/langchain/security/advisories/GHSA-fv5p-p927-qmxr x_refsource_CONFIRM

---

langchain-text-splitters

• ==< 1.1.2

NIXPKGS-2026-1265

GitHub issue published 1 month, 4 weeks ago

Permalink CVE-2026-25660

updated 1 month, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 1 month, 4 weeks ago
• @LeSuisse published on GitHub 1 month, 4 weeks ago

Authentication bypass for certain API calls

• https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645 vendor-advisory

---

CodeChecker

• =<6.27.3

NIXPKGS-2026-1261

GitHub issue published 1 month, 4 weeks ago

Permalink CVE-2026-41894

updated 1 month, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 1 month, 4 weeks ago
• @LeSuisse published on GitHub 1 month, 4 weeks ago

SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hjh7-r5w8-5872 x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7 x_refsource_MISC

Ignored references (1)

• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.5 x_refsource_MISC

---

siyuan

• ==< 3.6.5

NIXPKGS-2026-1263

GitHub issue published 1 month, 4 weeks ago

Permalink CVE-2026-38743

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 1 month, 4 weeks ago
• @LeSuisse published on GitHub 1 month, 4 weeks ago

Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities

• https://github.com/apache/airflow/pull/64822 patch
• https://lists.apache.org/thread/sk2wj0x48o8qb4p7c47gvnhjbm0mg396 vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/04/24/3

---

apache-airflow

• <3.2.1

NIXPKGS-2026-1260

GitHub issue published 1 month, 4 weeks ago

Permalink CVE-2026-42095

4.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 month, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 1 month, 4 weeks ago
• @LeSuisse published on GitHub 1 month, 4 weeks ago

bookserver in KDE Arianna before 26.04.1 allows attackers to read …

• https://kde.org/info/security/advisory-20260424-1.txt
• https://invent.kde.org/graphics/arianna/-/commit/485851d25de279a9d2711d37804435…
• https://invent.kde.org/graphics/arianna/-/commit/3cd56fce103ab62887c5592827d78a…

Ignored references (1)

• https://github.com/KDE/arianna/tags

---

Arianna

• <26.04.1

NIXPKGS-2026-1259

GitHub issue published 1 month, 4 weeks ago

Permalink CVE-2026-41327

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 month, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  5 packages

  • coqPackages.dpdgraph
  • perlPackages.GDGraph
  • perl5Packages.GDGraph
  • perl538Packages.GDGraph
  • perl540Packages.GDGraph
  1 month, 4 weeks ago
• @LeSuisse accepted 1 month, 4 weeks ago
• @LeSuisse published on GitHub 1 month, 4 weeks ago

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77 x_refsource_CONFIRMexploit
• https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3 x_refsource_MISC

---

dgraph

• ==< 25.3.3

NIXPKGS-2026-1258

GitHub issue published 1 month, 4 weeks ago

Permalink CVE-2026-41305

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 month, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  2 packages

  • nodePackages.postcss
  • nodePackages_latest.postcss
  1 month, 4 weeks ago
• @LeSuisse restored
  2 packages

  • nodePackages.postcss
  • nodePackages_latest.postcss
  1 month, 4 weeks ago
• @LeSuisse accepted 1 month, 4 weeks ago
• @LeSuisse published on GitHub 1 month, 4 weeks ago

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

• https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93 x_refsource_CONFIRMexploit

Ignored references (1)

• https://github.com/postcss/postcss/releases/tag/8.5.10 x_refsource_MISC

---

postcss

• ==< 8.5.10

NIXPKGS-2026-1257

GitHub issue published 1 month, 4 weeks ago

Permalink CVE-2026-41476

updated 1 month, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 1 month, 4 weeks ago
• @LeSuisse published on GitHub 1 month, 4 weeks ago

Deskflow: clipboard deserialization global-buffer-overflow

• https://github.com/deskflow/deskflow/security/advisories/GHSA-3jp5-g964-cgmh x_refsource_CONFIRMexploit

---

deskflow

• ==< 1.26.0.138