NIXPKGS-2026-1814

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10194

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): Not Defined (X)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  2 references

  • CVE-2026-10194 | CVE Analysis and Report
  • VDB-367475 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

OFFIS DCMTK dcmqrscp dcmqrdbi.cc deleteOldestImages heap-based overflow

• VDB-367475 | OFFIS DCMTK dcmqrscp dcmqrdbi.cc deleteOldestImages heap-based overflow technical-descriptionvdb-entry
• Submit #821029 | DCMTK v3.7.0+ DEV Heap-based Buffer Overflow third-party-advisory
• https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=0f78a4ef6f645ea5530166e445e5436a5… patchbroken-link

Ignored references (2)

• VDB-367475 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-10194 | CVE Analysis and Report third-party-advisory

---

DCMTK

• ==3.7.0

NIXPKGS-2026-1813

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10197

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  4 references

  • https://github.com/assimp/assimp/
  • CVE-2026-10197 | CVE Analysis and Report
  • VDB-367477 | CTI Indicators (IOB, IOC, …
  • Submit #821177 | Assimp commit 17c12da …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Assimp TF File glTF2Importer.cpp ImportEmbeddedTextures null pointer dereference

• VDB-367477 | Assimp TF File glTF2Importer.cpp ImportEmbeddedTextures null pointer dereference technical-descriptionvdb-entry
• https://github.com/assimp/assimp/issues/6608 issue-tracking
• https://github.com/user-attachments/files/27193894/poc.zip exploit
• https://github.com/assimp/assimp/pull/6645 patchissue-tracking

Ignored references (4)

• VDB-367477 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-10197 | CVE Analysis and Report third-party-advisory
• Submit #821177 | Assimp commit 17c12da NULL Pointer Dereference third-party-advisory
• https://github.com/assimp/assimp/ product

---

Assimp

• ==6.0.4
• ==6.0.0
• ==6.0.3
• ==6.0.2
• ==6.0.1

NIXPKGS-2026-1812

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10198

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  4 references

  • https://github.com/assimp/assimp/
  • CVE-2026-10198 | CVE Analysis and Report
  • VDB-367478 | CTI Indicators (IOB, IOC, …
  • Submit #821178 | Assimp commit 17c12da …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference

• VDB-367478 | Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference technical-descriptionvdb-entry
• https://github.com/assimp/assimp/issues/6609 issue-tracking
• https://github.com/user-attachments/files/27193865/poc.zip exploit

Ignored references (4)

• VDB-367478 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-10198 | CVE Analysis and Report third-party-advisory
• Submit #821178 | Assimp commit 17c12da NULL Pointer Dereference third-party-advisory
• https://github.com/assimp/assimp/ product

---

Assimp

• ==6.0.4
• ==6.0.0
• ==6.0.3
• ==6.0.2
• ==6.0.1

NIXPKGS-2026-1811

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10174

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored package raider 3 months, 2 weeks ago
• @LeSuisse ignored
  3 references

  • VDB-367455 | CTI Indicators (IOB, IOC, …
  • CVE-2026-10174 | CVE Analysis and Report
  • https://github.com/Aider-AI/aider/
  3 months, 2 weeks ago
• @LeSuisse ignored package pkgsRocm.vimPlugins.aider-nvim 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Aider-AI Aider Pre-commit Hook args.py protection mechanism

• VDB-367455 | Aider-AI Aider Pre-commit Hook args.py protection mechanism technical-descriptionvdb-entry
• Submit #819901 | disler aider 0.86.3 Security Bypass third-party-advisory
• https://github.com/Aider-AI/aider/issues/5057 issue-trackingexploit

Ignored references (3)

• VDB-367455 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-10174 | CVE Analysis and Report third-party-advisory
• https://github.com/Aider-AI/aider/ product

---

Aider

• ==0.86.3

NIXPKGS-2026-1810

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10177

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  2 packages

  • raider
  • pkgsRocm.vimPlugins.aider-nvim
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgery

• VDB-367458 | Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgery technical-descriptionvdb-entry
• VDB-367458 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-10177 | CVE Analysis and Report third-party-advisory
• Submit #819911 | paul-gauthier Aider 0.86.3 Server-Side Request Forgery third-party-advisory
• https://github.com/Aider-AI/aider/issues/5075 exploitissue-tracking
• https://github.com/Aider-AI/aider/pull/5137 patchissue-tracking
• https://github.com/Aider-AI/aider/ product

---

Aider

• ==0.86.3

NIXPKGS-2026-1809

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10176

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  3 references

  • VDB-367457 | CTI Indicators (IOB, IOC, …
  • CVE-2026-10176 | CVE Analysis and Report
  • https://github.com/Aider-AI/aider/
  3 months, 2 weeks ago
• @LeSuisse ignored
  2 packages

  • raider
  • pkgsRocm.vimPlugins.aider-nvim
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Aider-AI Aider Code Generation Workflow sql injection

• VDB-367457 | Aider-AI Aider Code Generation Workflow sql injection vdb-entry
• Submit #819910 | paul-gauthier Aider 0.86.3 Code Injection third-party-advisory
• https://github.com/Aider-AI/aider/issues/5077 exploitissue-tracking

Ignored references (3)

• VDB-367457 | CTI Indicators (IOB, IOC, TTP) signaturepermissions-required
• CVE-2026-10176 | CVE Analysis and Report third-party-advisory
• https://github.com/Aider-AI/aider/ product

---

Aider

• ==0.86.3

NIXPKGS-2026-1808

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10199

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  4 references

  • https://github.com/assimp/assimp/
  • Submit #821179 | Assimp commit 17c12da …
  • CVE-2026-10199 | CVE Analysis and Report
  • VDB-367479 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Assimp glTF2Asset.h LazyDict null pointer dereference

• VDB-367479 | Assimp glTF2Asset.h LazyDict null pointer dereference technical-descriptionvdb-entry
• https://github.com/assimp/assimp/issues/6611 issue-tracking
• https://github.com/assimp/assimp/pull/6646 patchissue-tracking
• https://github.com/user-attachments/files/27194148/poc.zip exploit
• https://github.com/assimp/assimp/commit/d24b85319bd70c65883a2b96613e07e23fb95981 patch

Ignored references (4)

• VDB-367479 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-10199 | CVE Analysis and Report third-party-advisory
• Submit #821179 | Assimp commit 17c12da NULL Pointer Dereference third-party-advisory
• https://github.com/assimp/assimp/ product

---

Assimp

• ==6.0.4
• ==6.0.0
• ==6.0.3
• ==6.0.2
• ==6.0.1

NIXPKGS-2026-1807

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10201

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  4 references

  • https://github.com/assimp/assimp/
  • Submit #821182 | Assimp commit 17c12da …
  • CVE-2026-10201 | CVE Analysis and Report
  • VDB-367481 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Assimp UV Channel FBXExporter.cpp WriteObjects divide by zero

• VDB-367481 | Assimp UV Channel FBXExporter.cpp WriteObjects divide by zero technical-descriptionvdb-entry
• https://github.com/assimp/assimp/issues/6613 issue-tracking
• https://github.com/user-attachments/files/27153727/poc.zip exploit

Ignored references (4)

• VDB-367481 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-10201 | CVE Analysis and Report third-party-advisory
• Submit #821182 | Assimp commit 17c12da Divide By Zero third-party-advisory
• https://github.com/assimp/assimp/ product

---

Assimp

• ==6.0.4
• ==6.0.0
• ==6.0.3
• ==6.0.2
• ==6.0.1

NIXPKGS-2026-1806

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10175

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  4 references

  • https://github.com/Aider-AI/aider/
  • Submit #819909 | paul-gauthier aider 0.…
  • CVE-2026-10175 | CVE Analysis and Report
  • VDB-367456 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse ignored
  2 packages

  • raider
  • pkgsRocm.vimPlugins.aider-nvim
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Aider-AI Aider Architect Mode auth.py editor_coder.run code injection

• VDB-367456 | Aider-AI Aider Architect Mode auth.py editor_coder.run code injection technical-descriptionvdb-entry
• https://github.com/Aider-AI/aider/issues/5058 issue-trackingexploit

Ignored references (4)

• VDB-367456 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• CVE-2026-10175 | CVE Analysis and Report third-party-advisory
• Submit #819909 | paul-gauthier aider 0.86.3 Code Injection third-party-advisory
• https://github.com/Aider-AI/aider/ product

---

Aider

• ==0.86.3

NIXPKGS-2026-1805

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10200

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  4 references

  • https://github.com/assimp/assimp/
  • Submit #821180 | Assimp commit 17c12da …
  • CVE-2026-10200 | CVE Analysis and Report
  • VDB-367480 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Assimp 4x4 Matrix glTFCommon.h CopyValue heap-based overflow

• VDB-367480 | Assimp 4x4 Matrix glTFCommon.h CopyValue heap-based overflow technical-descriptionvdb-entry
• https://github.com/assimp/assimp/issues/6612 issue-tracking
• https://github.com/user-attachments/files/27194256/poc.zip exploit

Ignored references (4)

• VDB-367480 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-10200 | CVE Analysis and Report third-party-advisory
• Submit #821180 | Assimp commit 17c12da Heap-based Buffer Overflow third-party-advisory
• https://github.com/assimp/assimp/ product

---

Assimp

• ==6.0.0
• ==6.0.3
• ==6.0.4
• ==6.0.1
• ==6.0.2