NIXPKGS-2026-1754

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48962

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  9 packages

  • perlPackages.CompressZlib
  • perl538Packages.IOCompress
  • perl5Packages.CompressZlib
  • perl538Packages.CompressZlib
  • perl540Packages.IOCompressBrotli
  • perl538Packages.IOCompressBrotli
  • perl5Packages.IOCompressBrotli
  • perlPackages.IOCompressBrotli
  • perl540Packages.CompressZlib
  3 months, 2 weeks ago
• @LeSuisse restored package perl538Packages.IOCompress 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

• https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b… patch
• https://metacpan.org/release/PMQS/IO-Compress-2.220/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/05/27/4

---

IO-Compress

• <2.220

NIXPKGS-2026-1753

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2025-15649

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  8 packages

  • perlPackages.CompressZlib
  • perlPackages.IOCompressBrotli
  • perl5Packages.IOCompressBrotli
  • perl538Packages.IOCompressBrotli
  • perl540Packages.CompressZlib
  • perl540Packages.IOCompressBrotli
  • perl5Packages.CompressZlib
  • perl538Packages.CompressZlib
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date

• https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf… patch
• https://github.com/pmqs/IO-Compress/issues/65 issue-tracking
• https://metacpan.org/release/PMQS/IO-Compress-2.215/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/05/27/1

---

IO-Compress

• <2.215

NIXPKGS-2026-1752

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44590

9.3 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  2 packages

  • sherlock-launcher
  • open-music-kontrollers.sherlock
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Sherlock: Command Injection via pull_request_target in validate_modified_targets.yml

• https://github.com/sherlock-project/sherlock/security/advisories/GHSA-v6wr-ccr4-x8g9 x_refsource_CONFIRM

---

sherlock

• ==< 0.16.1

NIXPKGS-2026-1751

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44776

5.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Kavita: IDOR in /api/Download/*

• https://github.com/Kareadita/Kavita/security/advisories/GHSA-x3jq-95xw-gwvr exploitx_refsource_CONFIRM

---

Kavita

• ==< 0.9.0

NIXPKGS-2026-1750

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-45104

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored package minetest-mapserver 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`

• https://github.com/MapServer/MapServer/security/advisories/GHSA-4h8g-378q-r75m x_refsource_CONFIRM

---

MapServer

• ==>= 6.4.0, < 8.6.3

NIXPKGS-2026-1749

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-45137

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  3 packages

  • python312Packages.anchor-kr
  • python313Packages.anchor-kr
  • python314Packages.anchor-kr
  3 months, 2 weeks ago
• @LeSuisse ignored maintainer @Denommus 3 months, 2 weeks ago maintainer.ignore
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Anchor: Program<'info, System> is not properly validated

• https://github.com/otter-sec/anchor/security/advisories/GHSA-c6rc-8jpp-2fgc x_refsource_CONFIRM

---

anchor

• ==>= 1.0.0, < 1.0.2

NIXPKGS-2026-1748

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-45090

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored maintainer @fabaff 3 months, 2 weeks ago maintainer.ignore
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)

• https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4 x_refsource_CONFIRM
• https://github.com/hahwul/dalfox/releases/tag/v2.13.0 x_refsource_MISC

---

dalfox

• ==< 2.13.0

NIXPKGS-2026-1747

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-45088

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored maintainer @fabaff 3 months, 2 weeks ago maintainer.ignore
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode

• https://github.com/hahwul/dalfox/security/advisories/GHSA-35wr-x7v6-9fv2 x_refsource_CONFIRMexploit
• https://github.com/hahwul/dalfox/releases/tag/v2.13.0 x_refsource_MISC

---

dalfox

• ==< 2.13.0

NIXPKGS-2026-1746

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-45089

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored maintainer @fabaff 3 months, 2 weeks ago maintainer.ignore
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode

• https://github.com/hahwul/dalfox/security/advisories/GHSA-8hf9-3q64-q2qf x_refsource_CONFIRM
• https://github.com/hahwul/dalfox/releases/tag/v2.13.0 x_refsource_MISC

---

dalfox

• ==< 2.13.0

NIXPKGS-2026-1745

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44838

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

RabbitMQ MQTT Topic Permission Authorization Bypass

• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x866-xp2g-cx8v x_refsource_CONFIRM

---

rabbitmq-server

• ==>= 4.2.0, < 4.2.4