NIXPKGS-2026-1804

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48840

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  3 maintainers

  • @4z3
  • @dasJ
  • @helsinki-Jo
  3 months, 2 weeks ago maintainer.ignore
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain …

• https://exim.org/static/doc/security/EXIM-Security-2026-05-19.1
• https://www.openwall.com/lists/oss-security/2026/05/29/3
• http://www.openwall.com/lists/oss-security/2026/05/29/3

---

Exim

• <4.99.4

NIXPKGS-2026-1803

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48525

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39 x_refsource_CONFIRMexploit

---

pyjwt

• ==>= 2.8.0, < 2.13.0

NIXPKGS-2026-1802

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-45306

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  4 packages

  • python312Packages.pyloadapi
  • python313Packages.pyloadapi
  • python314Packages.pyloadapi
  • home-assistant-component-tests.pyload
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory

• https://github.com/pyload/pyload/security/advisories/GHSA-w727-595x-pc3r exploitx_refsource_CONFIRM

---

pyload

• ==< 0.5.0b3.dev100

NIXPKGS-2026-1801

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48735

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  10 packages

  • capypdf
  • python312Packages.pypdf2
  • python312Packages.pypdf3
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python312Packages.pypdfium2
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

pypdf: Manipulated XMP metadata streams can exhaust RAM

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3796 x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.12.1 x_refsource_MISC

---

pypdf

• ==< 6.12.1

Patch: https://github.com/py-pdf/pypdf/commit/62191d5a5c3ee218856d3cbaa039366bc97909f7

NIXPKGS-2026-1800

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-41565

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers

• https://github.com/DCIT/perl-CryptX/commit/57e69e541b0718ca8724c2f61514322a2d85… patch
• https://github.com/DCIT/perl-CryptX/commit/7e56347d420aaf43b2ee1586f4a230492ccf… patch
• https://metacpan.org/release/MIK/CryptX-0.088_001 release-notes
• http://www.openwall.com/lists/oss-security/2026/05/28/10

---

CryptX

• <0.088_001

NIXPKGS-2026-1799

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48526

7.4 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx x_refsource_CONFIRM

---

pyjwt

• ==< 2.13.0

NIXPKGS-2026-1798

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-46561

5.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  4 packages

  • home-assistant-component-tests.pyload
  • python314Packages.pyloadapi
  • python312Packages.pyloadapi
  • python313Packages.pyloadapi
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API

• https://github.com/pyload/pyload/security/advisories/GHSA-8rp3-xc6w-5qp5 x_refsource_CONFIRMexploit

---

pyload

• ==< 0.5.0b3.dev100

NIXPKGS-2026-1797

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48522

4.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4 x_refsource_CONFIRM

---

pyjwt

• ==< 2.13.0

NIXPKGS-2026-1796

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-45348

8.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  4 packages

  • python312Packages.pyloadapi
  • python313Packages.pyloadapi
  • python314Packages.pyloadapi
  • home-assistant-component-tests.pyload
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal

• https://github.com/pyload/pyload/security/advisories/GHSA-fcjq-435v-jx94 x_refsource_CONFIRMexploit

---

pyload

• ==< 0.5.0b3.dev100

NIXPKGS-2026-1795

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48524

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8 x_refsource_CONFIRM

---

pyjwt

• ==< 2.13.0