NIXPKGS-2026-1824

GitHub issue published 3 months, 1 week ago

Permalink CVE-2026-40861

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler

• https://github.com/apache/airflow/pull/65325 patch
• https://lists.apache.org/thread/823334db2559xjlwt59gpzjz47thnscl vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/05/31/1

---

apache-airflow

• <3.2.2

NIXPKGS-2026-1822

GitHub issue published 3 months, 1 week ago

Permalink CVE-2026-41017

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy

• https://github.com/apache/airflow/pull/65348 patch
• https://lists.apache.org/thread/9jx0sk49c1250zflx0q3clc717qgjdch vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/05/31/6

---

apache-airflow

• <3.2.2

NIXPKGS-2026-1821

GitHub issue published 3 months, 1 week ago

Permalink CVE-2026-45426

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access

• https://github.com/apache/airflow/pull/66749 patch
• https://lists.apache.org/thread/hz1q7vg65vq2h4fobv5ww8tp257fbqj9 vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/05/31/13

---

apache-airflow

• <3.2.2

NIXPKGS-2026-1823

GitHub issue published 3 months, 1 week ago

Permalink CVE-2026-41084

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation

• https://github.com/apache/airflow/pull/64288 patch
• https://lists.apache.org/thread/w0hdcqfr71hf9rl1bwvpjs7q9yp1bldk vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/05/31/7

---

apache-airflow

• <3.2.2

NIXPKGS-2026-1820

GitHub issue published 3 months, 1 week ago

Permalink CVE-2026-49298

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments

• https://github.com/apache/airflow/pull/60108 patch
• https://lists.apache.org/thread/wo09vrks8189dzsot39rvrx3vnx102tt vendor-advisory

---

apache-airflow

• <3.2.2

NIXPKGS-2026-1819

GitHub issue published 3 months, 1 week ago

Permalink CVE-2026-43958

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • python312Packages.rrdtool
  • python314Packages.rrdtool
  • python313Packages.rrdtool
  3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service

• https://access.redhat.com/security/cve/CVE-2026-43958 x_refsource_REDHATvdb-entry
• RHBZ#2460932 x_refsource_REDHATissue-tracking

---

rrdtool

NIXPKGS-2026-1818

GitHub issue published 3 months, 1 week ago

Permalink CVE-2026-10230

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse ignored
  4 references

  • CVE-2026-10230 | CVE Analysis and Report
  • VDB-367509 | CTI Indicators (IOB, IOC, …
  • Submit #821190 | Assimp commit 17c12da …
  • https://github.com/assimp/assimp/
  3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_animations heap-based overflow

• VDB-367509 | Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_animations heap-based overflow technical-descriptionvdb-entry
• https://github.com/assimp/assimp/issues/6615 exploitissue-tracking

Ignored references (4)

• VDB-367509 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-10230 | CVE Analysis and Report third-party-advisory
• Submit #821190 | Assimp commit 17c12da Heap-based Buffer Overflow third-party-advisory
• https://github.com/assimp/assimp/ product

---

Assimp

• ==6.0.4
• ==6.0.0
• ==6.0.3
• ==6.0.2
• ==6.0.1

NIXPKGS-2026-1817

GitHub issue published 3 months, 1 week ago

Permalink CVE-2026-10275

1.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse ignored
  5 references

  • https://github.com/OpenSC/OpenSC/
  • CVE-2026-10275 | CVE Analysis and Report
  • VDB-367568 | CTI Indicators (IOB, IOC, …
  • Submit #825403 | OpenSC OpenSC 0.26.1 a…
  • https://pan.baidu.com/s/1nrZPKDz2eAcCps…
  3 months, 1 week ago
• @LeSuisse ignored
  11 packages

  • openscad
  • openscap
  • openscreen
  • openscad-lsp
  • openscenegraph
  • openscad-unstable
  • kakounePlugins.openscad-kak
  • vscode-extensions.antyos.openscad
  • tree-sitter-grammars.tree-sitter-openscad
  • python313Packages.tree-sitter-grammars.tree-sitter-openscad
  • python314Packages.tree-sitter-grammars.tree-sitter-openscad
  3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

OpenSC pkcs11-tool Key Generation pkcs11-tool.c test_kpgen_certwrite buffer overflow

• VDB-367568 | OpenSC pkcs11-tool Key Generation pkcs11-tool.c test_kpgen_certwrite buffer overflow technical-descriptionvdb-entry
• https://github.com/OpenSC/OpenSC/issues/3682 issue-tracking
• https://github.com/OpenSC/OpenSC/pull/3684 patchissue-tracking
• https://github.com/OpenSC/OpenSC/commit/814f745b3b6d100295f65f1935edd33d520d33ab patch

Ignored references (5)

• VDB-367568 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-10275 | CVE Analysis and Report third-party-advisory
• Submit #825403 | OpenSC OpenSC 0.26.1 and earlier Buffer Overflow third-party-advisory
• https://pan.baidu.com/s/1nrZPKDz2eAcCpsaFiIRlrg exploit
• https://github.com/OpenSC/OpenSC/ product

---

OpenSC

• ==0.26.1
• ==0.26.0

NIXPKGS-2026-1816

GitHub issue published 3 months, 1 week ago

Permalink CVE-2026-10294

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse ignored
  4 references

  • https://github.com/PackageKit/PackageKi…
  • Submit #826470 | PackageKit v1.3.5 Inco…
  • CVE-2026-10294 | CVE Analysis and Report
  • VDB-367587 | CTI Indicators (IOB, IOC, …
  3 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • qt6Packages.packagekit-qt
  • kdePackages.packagekit-qt
  • gnome-packagekit
  3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

PackageKit API pk-transaction.c g_file_test improper authorization

• VDB-367587 | PackageKit API pk-transaction.c g_file_test improper authorization technical-descriptionvdb-entry
• https://github.com/PackageKit/PackageKit/issues/969 issue-trackingexploit

Ignored references (4)

• VDB-367587 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• CVE-2026-10294 | CVE Analysis and Report third-party-advisory
• Submit #826470 | PackageKit v1.3.5 Incorrect Use of Privileged APIs third-party-advisory
• https://github.com/PackageKit/PackageKit/ product

---

PackageKit

• ==1.3.4
• ==1.3.1
• ==1.3.3
• ==1.3.5
• ==1.3.0
• ==1.3.2

No available patch / fix (2026-05-02)

NIXPKGS-2026-1815

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-8796

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input

• https://github.com/Sereal/Sereal/commit/303a2c69cdba80bf37a3ff43461e0aa78198a7a… patch
• https://metacpan.org/release/YVES/Sereal-Decoder-5.005/changes release-notes

---

Sereal-Decoder

• <5.005