NIXPKGS-2026-1204

GitHub issue published 2 months ago

Permalink CVE-2026-5358

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse ignored
28 packages
- libc
- iconv
- getent
- locale
- mtrace
- getconf
- libiconv
- glibcInfo
- glibc_multi
- glibcLocales
- glibc_memusage
- glibcLocalesUtf8
- unixtools.getent
- unixtools.locale
- unixtools.getconf
- minimal-bootstrap.glibc
- tests.hardeningFlags.glibcxxassertionsStdenvUnsupp
- tests.hardeningFlags.glibcxxassertionsExplicitEnabled
- tests.hardeningFlags-gcc.glibcxxassertionsStdenvUnsupp
- tests.hardeningFlags.glibcxxassertionsExplicitDisabled
- tests.hardeningFlags-clang.glibcxxassertionsStdenvUnsupp
- tests.hardeningFlags-gcc.glibcxxassertionsExplicitEnabled
- tests.hardeningFlags.allExplicitDisabledGlibcxxAssertions
- tests.hardeningFlags-gcc.glibcxxassertionsExplicitDisabled
- tests.hardeningFlags-clang.glibcxxassertionsExplicitEnabled
- tests.hardeningFlags-clang.glibcxxassertionsExplicitDisabled
- tests.hardeningFlags-gcc.allExplicitDisabledGlibcxxAssertions
- tests.hardeningFlags-clang.allExplicitDisabledGlibcxxAssertions
2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Static buffer overflow in deprecated nis_local_principal

https://sourceware.org/bugzilla/show_bug.cgi?id=34067

glibc

=<2.43

https://www.openwall.com/lists/oss-security/2026/04/20/9

NIXPKGS-2026-1203

GitHub issue published 2 months ago

Permalink CVE-2026-5928

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse ignored
28 packages
- libc
- iconv
- locale
- mtrace
- getconf
- libiconv
- glibcInfo
- glibc_multi
- glibcLocales
- glibc_memusage
- glibcLocalesUtf8
- unixtools.getent
- unixtools.locale
- unixtools.getconf
- minimal-bootstrap.glibc
- tests.hardeningFlags.glibcxxassertionsStdenvUnsupp
- tests.hardeningFlags.glibcxxassertionsExplicitEnabled
- tests.hardeningFlags-gcc.glibcxxassertionsStdenvUnsupp
- tests.hardeningFlags.glibcxxassertionsExplicitDisabled
- tests.hardeningFlags-clang.glibcxxassertionsStdenvUnsupp
- tests.hardeningFlags-gcc.glibcxxassertionsExplicitEnabled
- tests.hardeningFlags.allExplicitDisabledGlibcxxAssertions
- tests.hardeningFlags-gcc.glibcxxassertionsExplicitDisabled
- tests.hardeningFlags-clang.glibcxxassertionsExplicitEnabled
- tests.hardeningFlags-clang.glibcxxassertionsExplicitDisabled
- tests.hardeningFlags-gcc.allExplicitDisabledGlibcxxAssertions
- tests.hardeningFlags-clang.allExplicitDisabledGlibcxxAssertions
- getent
2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Static buffer overflow in deprecated nis_local_principal

https://sourceware.org/bugzilla/show_bug.cgi?id=33998

glibc

=<2.43

https://www.openwall.com/lists/oss-security/2026/04/20/9

NIXPKGS-2026-1206

GitHub issue published 2 months ago

Permalink CVE-2026-5450

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse ignored
28 packages
- libc
- iconv
- getent
- locale
- mtrace
- getconf
- libiconv
- glibcInfo
- glibc_multi
- glibcLocales
- glibc_memusage
- glibcLocalesUtf8
- unixtools.getent
- unixtools.locale
- unixtools.getconf
- minimal-bootstrap.glibc
- tests.hardeningFlags.glibcxxassertionsStdenvUnsupp
- tests.hardeningFlags.glibcxxassertionsExplicitEnabled
- tests.hardeningFlags-gcc.glibcxxassertionsStdenvUnsupp
- tests.hardeningFlags.glibcxxassertionsExplicitDisabled
- tests.hardeningFlags-clang.glibcxxassertionsStdenvUnsupp
- tests.hardeningFlags-gcc.glibcxxassertionsExplicitEnabled
- tests.hardeningFlags.allExplicitDisabledGlibcxxAssertions
- tests.hardeningFlags-gcc.glibcxxassertionsExplicitDisabled
- tests.hardeningFlags-clang.glibcxxassertionsExplicitEnabled
- tests.hardeningFlags-clang.glibcxxassertionsExplicitDisabled
- tests.hardeningFlags-gcc.allExplicitDisabledGlibcxxAssertions
- tests.hardeningFlags-clang.allExplicitDisabledGlibcxxAssertions
2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

scanf %mc off-by-one heap buffer overflow

https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450 issue-tracking
https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3… mailing-list

glibc

*

https://www.openwall.com/lists/oss-security/2026/04/20/9

NIXPKGS-2026-1205

GitHub issue published 2 months ago

Permalink CVE-2026-40347

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data

https://github.com/Kludex/python-multipart/security/advisories/GHSA-mj87-hwqh-73pj x_refsource_CONFIRM

Ignored references (1)

https://github.com/Kludex/python-multipart/releases/tag/0.0.26 x_refsource_MISC

python-multipart

==< 0.0.26

NIXPKGS-2026-1201

GitHub issue published 2 months ago

          Permalink
          
            CVE-2026-28684
          
        6.6 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          2 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 months ago
          
          @LeSuisse
          
              accepted
            
          2 months ago
          
          @LeSuisse
          
              published on GitHub
            
          2 months ago
          
            python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
          
      https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94
    
    x_refsource_CONFIRMexploit
  
      https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311
    
    x_refsource_MISC
  
          Ignored references (1)
        
      https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2
    
    x_refsource_MISC
  
    python-dotenv

            ==< 1.2.2

NIXPKGS-2026-1202

GitHub issue published 2 months ago

          Permalink
          
            CVE-2026-32135
          
              updated
            
          2 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 months ago
          
          @LeSuisse
          
              accepted
            
          2 months ago
          
          @LeSuisse
          
              published on GitHub
            
          2 months ago
          
            NanoMQ has Heap Buffer Overflow in URI Parameter Parsing
          
      https://github.com/nanomq/nanomq/security/advisories/GHSA-6w96-9qw7-m599
    
    x_refsource_CONFIRM
  
      https://github.com/nanomq/nanomq/issues/2247
    
    x_refsource_MISC
  
      https://github.com/nanomq/nanomq/commit/69a97b3b39cc218f044f1c8896f4d3d8757bb394
    
    x_refsource_MISC
  
    nanomq

            ==< 0.24.11

NIXPKGS-2026-1199

GitHub issue published 2 months ago

Permalink CVE-2026-35587

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse ignored
5 packages
- python312Packages.glances-api
- python313Packages.glances-api
- python314Packages.glances-api
- home-assistant-component-tests.glances
- tests.home-assistant-components.glances
2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Glances IP Plugin has SSRF via public_api that leads to credential leakage

https://github.com/nicolargo/glances/security/advisories/GHSA-g5pq-48mj-jvw8 x_refsource_CONFIRM
https://github.com/nicolargo/glances/commit/d6808be66728956477cc4b544bab1acd71ac65fb x_refsource_MISC

glances

==< 4.5.4

NIXPKGS-2026-1200

GitHub issue published 2 months ago

Permalink CVE-2026-41445

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse ignored package kissfftFloat 2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

KissFFT Integer Overflow Heap Buffer Overflow via kiss_fftndr_alloc()

https://github.com/mborgerding/kissfft/commit/8a8e66e33d692bad1376fe7904d87d767… patch
https://www.vulncheck.com/advisories/kissfft-integer-overflow-heap-buffer-overf… third-party-advisory

kissfft

<8a8e66e33d692bad1376fe7904d87d767730537f

NIXPKGS-2026-1198

GitHub issue published 2 months ago

Permalink CVE-2026-41282

4.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse ignored
2 packages
- nuclei-templates
- nucleiparser
2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This …

Ignored references (1)

https://github.com/projectdiscovery/nuclei/pull/7221 exploit

Nuclei

<3.8.0

NIXPKGS-2026-1197

GitHub issue published 2 months ago

          Permalink
          
            CVE-2026-35588
          
        6.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): High (H)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): High (H)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          2 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 months ago
          
          @LeSuisse
          
              ignored
            
                5 packages
                python312Packages.glances-api
python313Packages.glances-api
python314Packages.glances-api
home-assistant-component-tests.glances
tests.home-assistant-components.glances

          2 months ago
          
          @LeSuisse
          
              accepted
            
          2 months ago
          
          @LeSuisse
          
              published on GitHub
            
          2 months ago
          
            Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
          
      https://github.com/nicolargo/glances/security/advisories/GHSA-grp3-h8m8-45p7
    
    x_refsource_CONFIRM
  
      https://github.com/nicolargo/glances/commit/d339181f03a14bb15506307e9d58f876e23d8160
    
    x_refsource_MISC
  
      https://github.com/nicolargo/glances/commit/e41b665576f9fd5374e3152078726cc59a01e48c
    
    x_refsource_MISC
  
    glances

            ==< 4.5.4

Nixpkgs security tracker

Published issues

Static buffer overflow in deprecated nis_local_principal

Static buffer overflow in deprecated nis_local_principal

scanf %mc off-by-one heap buffer overflow

Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data

python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

NanoMQ has Heap Buffer Overflow in URI Parameter Parsing

Glances IP Plugin has SSRF via public_api that leads to credential leakage

KissFFT Integer Overflow Heap Buffer Overflow via kiss_fftndr_alloc()

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This …

Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values