NIXPKGS-2026-1156

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-23500

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration

• https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-w5j3-8fcr-h87w x_refsource_CONFIRM

Ignored references (1)

• https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0 x_refsource_MISC

---

dolibarr

• ==< 23.0.0

NIXPKGS-2026-1155

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40303

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored maintainer @bennyandresen 2 months, 1 week ago maintainer.ignore
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing

• https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9 x_refsource_CONFIRM

Ignored references (1)

• https://github.com/openziti/zrok/releases/tag/v2.0.1 x_refsource_MISC

---

zrok

• ==< 2.0.1

NIXPKGS-2026-1154

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40302

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored maintainer @bennyandresen 2 months, 1 week ago maintainer.ignore
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering

• https://github.com/openziti/zrok/security/advisories/GHSA-4fxq-2x3x-6xqx x_refsource_CONFIRM

Ignored references (1)

• https://github.com/openziti/zrok/releases/tag/v2.0.1 x_refsource_MISC

---

zrok

• ==< 2.0.1

NIXPKGS-2026-1153

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40196

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @tebriel
  • @PatrickDaG
  2 months, 1 week ago maintainer.ignore
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9 x_refsource_CONFIRM
• https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0 x_refsource_MISC

---

homebox

• ==< 0.25.0

NIXPKGS-2026-1152

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40489

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored maintainer @dochang 2 months, 1 week ago maintainer.ignore
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

editorconfig-core-c has incomplete fix for CVE-2023-0341

• https://github.com/editorconfig/editorconfig-core-c/security/advisories/GHSA-97xg-vrcq-254h x_refsource_CONFIRM
• https://github.com/editorconfig/editorconfig-core-c/commit/5159be88ad50641d9843289adda791ba300421ff x_refsource_MISC

Ignored references (1)

• https://github.com/editorconfig/editorconfig-core-c/releases/tag/v0.12.11 x_refsource_MISC

---

editorconfig-core-c

• ==< 0.12.11

NIXPKGS-2026-1151

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-41082

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored
  23 packages

  • dopamine
  • opam2json
  • opam-publish
  • opam-installer
  • ocamlPackages.opam-core
  • ocamlPackages.opam-state
  • ocamlPackages.opam-client
  • ocamlPackages.opam-format
  • ocamlPackages.opam-solver
  • ocamlPackages.opam-repository
  • ocamlPackages.opam-file-format
  • ocamlPackages_latest.opam-core
  • ocamlPackages_latest.opam-state
  • ocamlPackages.opam-0install-cudf
  • ocamlPackages_latest.opam-client
  • ocamlPackages_latest.opam-format
  • ocamlPackages_latest.opam-solver
  • ocamlPackages_latest.opam-repository
  • ocamlPackages_latest.opam-file-format
  • tree-sitter-grammars.tree-sitter-opam
  • ocamlPackages_latest.opam-0install-cudf
  • python313Packages.tree-sitter-grammars.tree-sitter-opam
  • python314Packages.tree-sitter-grammars.tree-sitter-opam
  2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

In OCaml opam before 2.5.1, a .install field containing a …

• https://github.com/ocaml/opam/releases/tag/2.5.1
• https://github.com/ocaml/opam/pull/6897

---

opam

• <2.5.1

NIXPKGS-2026-1149

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40260

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored
  10 packages

  • capypdf
  • python312Packages.pypdf2
  • python312Packages.pypdf3
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python312Packages.pypdfium2
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-3crg-w4f6-42mx x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3724 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/b15a374e5ca648d4878e57c3b2c0551e7f8cc7f8 x_refsource_MISC

Ignored references (1)

• https://github.com/py-pdf/pypdf/releases/tag/6.10.0 x_refsource_MISC

---

pypdf

• ==< 6.10.0

NIXPKGS-2026-1150

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40253

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c

• https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-c9cf-6vr4-wfxm x_refsource_CONFIRM
• https://github.com/opencryptoki/opencryptoki/commit/ed378f463ef73364c89feb0fc923f4dc867332a3 x_refsource_MISC

---

opencryptoki

• ==<= 3.26.0

NIXPKGS-2026-1148

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40170

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored package ngtcp2-gnutls 2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

ngtcp2 has a qlog transport parameter serialization stack buffer overflow

• https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8f x_refsource_CONFIRM
• https://github.com/ngtcp2/ngtcp2/commit/708a7640c1f48fb8ffb540c4b8ea5b4c1dfb8ee5 x_refsource_MISC

---

ngtcp2

• ==< 1.22.1

NIXPKGS-2026-1147

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40318

8.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vw86-c94w-v3x4 x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 x_refsource_MISC

---

siyuan

• ==< 3.6.4