NIXPKGS-2026-1784

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10113

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  3 references

  • https://github.com/open5gs/open5gs/
  • Submit #818581 | Open5GS NRF/AMF/AUSF/B…
  • VDB-367291 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse ignored package open5gs-webui 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Open5GS Shared NF-profile nnrf-handler.c denial of service

• VDB-367291 | Open5GS Shared NF-profile nnrf-handler.c denial of service vdb-entry
• https://github.com/open5gs/open5gs/issues/4467 exploitissue-tracking
• https://github.com/open5gs/open5gs/pull/4527 patchissue-tracking

Ignored references (3)

• VDB-367291 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
• Submit #818581 | Open5GS NRF/AMF/AUSF/BSF/NSSF/PCF/SMF/UDM/UDR v2.7.7 Denial of Service third-party-advisory
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.7
• ==2.7.3
• ==2.7.5
• ==2.7.1
• ==2.7.0
• ==2.7.4
• ==2.7.6
• ==2.7.2

NIXPKGS-2026-1783

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10116

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  3 references

  • https://github.com/open5gs/open5gs/
  • Submit #818585 | Open5GS AUSF v2.7.7 De…
  • VDB-367294 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse ignored package open5gs-webui 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of service

• VDB-367294 | Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of service technical-descriptionvdb-entry
• https://github.com/open5gs/open5gs/issues/4473 issue-trackingexploit
• https://github.com/open5gs/open5gs/pull/4578 patchissue-tracking

Ignored references (3)

• VDB-367294 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• Submit #818585 | Open5GS AUSF v2.7.7 Denial of Service third-party-advisory
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.0
• ==2.7.6
• ==2.7.1
• ==2.7.5
• ==2.7.2
• ==2.7.4
• ==2.7.7
• ==2.7.3

NIXPKGS-2026-1782

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-10114

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored package open5gs-webui 3 months, 2 weeks ago
• @LeSuisse ignored
  3 references

  • https://github.com/open5gs/open5gs/
  • Submit #818582 | Open5GS AMF、AUSF、BSF、N…
  • VDB-367292 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds write

• VDB-367292 | Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds write technical-descriptionvdb-entry
• https://github.com/open5gs/open5gs/issues/4468 issue-trackingexploit

Ignored references (3)

• VDB-367292 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• Submit #818582 | Open5GS AMF、AUSF、BSF、NSSF、PCF、SMF、UDM、UDR、SCP、SEPP、NRF v2.7.7 Denial of Service third-party-advisory
• https://github.com/open5gs/open5gs/ product

---

Open5GS

• ==2.7.0
• ==2.7.6
• ==2.7.1
• ==2.7.5
• ==2.7.2
• ==2.7.4
• ==2.7.7
• ==2.7.3

NIXPKGS-2026-1781

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-8594

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters

• https://metacpan.org/release/NEZUMI/Unicode-LineBreak-2019.001/source/lib/Text/…
• https://security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-859… patch
• https://github.com/hatukanezumi/Unicode-LineBreak/pull/6 issue-tracking
• http://www.openwall.com/lists/oss-security/2026/05/30/6

---

Unicode-LineBreak

• =<2019.001

Patch: https://security.metacpan.org/patches/U/Unicode-LineBreak/2019.001/CVE-2026-8594-r1.patch

NIXPKGS-2026-1780

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44353

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored package streamlink-twitch-gui-bin 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Streamlink: Arbitrary local file read via file:// URI in HLS and DASH

• https://github.com/streamlink/streamlink/security/advisories/GHSA-hgqw-6m45-hw5f x_refsource_CONFIRMexploit

---

streamlink

• ==< 8.4.0

NIXPKGS-2026-1779

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-45261

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

GitButler: Link injection via forge integration enables arbitrary script execution

• https://github.com/gitbutlerapp/gitbutler/security/advisories/GHSA-xpmj-536r-9fc6 x_refsource_CONFIRM

---

gitbutler

• ==< 0.19.7

NIXPKGS-2026-1778

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-4408

9.0 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored package sambamba 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Samba: remote code execution in samr

• https://access.redhat.com/security/cve/CVE-2026-4408 x_refsource_REDHATvdb-entry
• RHBZ#2479762 x_refsource_REDHATissue-tracking
• https://bugzilla.samba.org/show_bug.cgi?id=16034

---

rhcos

samba

samba4

https://www.samba.org/samba/security/CVE-2026-4408.html

NIXPKGS-2026-1777

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-49127

8.8 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  11 packages

  • ympd
  • mpdas
  • mympd
  • compdb
  • libmpd
  • mpdcron
  • mpdris2
  • mpd-sima
  • rofi-mpd
  • rtmpdump
  • mpd-mpris
  3 months, 2 weeks ago
• @LeSuisse ignored reference https://w… 3 months, 2 weeks ago
• @LeSuisse ignored
  35 packages

  • mpdecimal
  • termpdfpy
  • mopidy-mpd
  • mpdris2-rs
  • pam_tmpdir
  • mpdscribble
  • dash-mpd-cli
  • libmpdclient
  • mpd-discord-rpc
  • rtmpdump_gnutls
  • listenbrainz-mpd
  • mpd-notification
  • perlPackages.NetMPD
  • mpd-touch-screen-gui
  • perl5Packages.NetMPD
  • haskellPackages.libmpd
  • perl538Packages.NetMPD
  • perl540Packages.NetMPD
  • python312Packages.mpd2
  • python313Packages.mpd2
  • python314Packages.mpd2
  • writableTmpDirAsHomeHook
  • mopidyPackages.mopidy-mpd
  • perlPackages.FileUtilTempdir
  • perlPackages.TestTempDirTiny
  • perl5Packages.FileUtilTempdir
  • perl5Packages.TestTempDirTiny
  • perl538Packages.FileUtilTempdir
  • perl538Packages.TestTempDirTiny
  • perl540Packages.FileUtilTempdir
  • perl540Packages.TestTempDirTiny
  • haskellPackages.mpd-current-json
  • haskellPackages.compdata-fixplate
  • home-assistant-component-tests.mpd
  • chickenPackages_5.chickenEggs.mpd-client
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be

• https://mstreet97.github.io/security-research/opensource/vulnerability-disclosu… technical-descriptionexploit
• https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/ release-notespatch
• https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS release-notes
• https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11 release-notes
• https://github.com/MusicPlayerDaemon/MPD/issues/2485 issue-tracking
• https://github.com/MusicPlayerDaemon/MPD/commit/59911028c020f84bc2e669da6a1ef88… patch

Ignored references (1)

• https://www.vulncheck.com/advisories/music-player-daemon-stack-buffer-overflow-… third-party-advisory

---

MPD

• <0.24.11

NIXPKGS-2026-1776

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-49129

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  10 packages

  • ympd
  • mpdas
  • mympd
  • compdb
  • libmpd
  • mpdcron
  • mpdris2
  • mpd-sima
  • rofi-mpd
  • rtmpdump
  3 months, 2 weeks ago
• @LeSuisse ignored reference https://w… 3 months, 2 weeks ago
• @LeSuisse ignored
  36 packages

  • mpd-mpris
  • mpdecimal
  • termpdfpy
  • mopidy-mpd
  • mpdris2-rs
  • pam_tmpdir
  • mpdscribble
  • dash-mpd-cli
  • libmpdclient
  • mpd-discord-rpc
  • rtmpdump_gnutls
  • listenbrainz-mpd
  • mpd-notification
  • perlPackages.NetMPD
  • mpd-touch-screen-gui
  • perl5Packages.NetMPD
  • haskellPackages.libmpd
  • perl538Packages.NetMPD
  • perl540Packages.NetMPD
  • python312Packages.mpd2
  • python313Packages.mpd2
  • python314Packages.mpd2
  • writableTmpDirAsHomeHook
  • mopidyPackages.mopidy-mpd
  • perlPackages.FileUtilTempdir
  • perlPackages.TestTempDirTiny
  • perl5Packages.FileUtilTempdir
  • perl5Packages.TestTempDirTiny
  • perl538Packages.FileUtilTempdir
  • perl538Packages.TestTempDirTiny
  • perl540Packages.FileUtilTempdir
  • perl540Packages.TestTempDirTiny
  • chickenPackages_5.chickenEggs.mpd-client
  • home-assistant-component-tests.mpd
  • haskellPackages.compdata-fixplate
  • haskellPackages.mpd-current-json
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin

• https://mstreet97.github.io/security-research/opensource/vulnerability-disclosu… technical-descriptionexploit
• https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/ release-notespatch
• https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS release-notes
• https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11 release-notes
• https://github.com/MusicPlayerDaemon/MPD/issues/2487 issue-tracking
• https://github.com/MusicPlayerDaemon/MPD/commit/78341dd6c7b101c3feede233d4cc4f8… patch

Ignored references (1)

• https://www.vulncheck.com/advisories/music-player-daemon-ssrf-via-curlinputplug… third-party-advisory

---

MPD

• <0.24.11

NIXPKGS-2026-1775

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-49130

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  46 packages

  • ympd
  • mpdas
  • mympd
  • compdb
  • libmpd
  • mpdcron
  • mpdris2
  • mpd-sima
  • rofi-mpd
  • rtmpdump
  • mpd-mpris
  • mpdecimal
  • termpdfpy
  • mopidy-mpd
  • mpdris2-rs
  • pam_tmpdir
  • mpdscribble
  • dash-mpd-cli
  • libmpdclient
  • mpd-discord-rpc
  • rtmpdump_gnutls
  • listenbrainz-mpd
  • mpd-notification
  • perlPackages.NetMPD
  • mpd-touch-screen-gui
  • perl5Packages.NetMPD
  • haskellPackages.libmpd
  • perl538Packages.NetMPD
  • perl540Packages.NetMPD
  • python312Packages.mpd2
  • python313Packages.mpd2
  • python314Packages.mpd2
  • writableTmpDirAsHomeHook
  • mopidyPackages.mopidy-mpd
  • perlPackages.FileUtilTempdir
  • perlPackages.TestTempDirTiny
  • perl5Packages.FileUtilTempdir
  • perl5Packages.TestTempDirTiny
  • chickenPackages_5.chickenEggs.mpd-client
  • home-assistant-component-tests.mpd
  • haskellPackages.compdata-fixplate
  • haskellPackages.mpd-current-json
  • perl540Packages.TestTempDirTiny
  • perl538Packages.TestTempDirTiny
  • perl540Packages.FileUtilTempdir
  • perl538Packages.FileUtilTempdir
  3 months, 2 weeks ago
• @LeSuisse ignored reference https://w… 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx

• https://mstreet97.github.io/security-research/opensource/vulnerability-disclosu… technical-descriptionexploit
• https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/ release-notespatch
• https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS release-notes
• https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11 release-notes
• https://github.com/MusicPlayerDaemon/MPD/issues/2483 issue-tracking
• https://github.com/MusicPlayerDaemon/MPD/commit/855085b35c67dddeef0652e2cb3ac8c… patch

Ignored references (1)

• https://www.vulncheck.com/advisories/music-player-daemon-crlf-injection-via-xsp… third-party-advisory

---

MPD

• <0.24.11