NIXPKGS-2026-1734

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-9567

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  4 references

  • https://github.com/gpac/gpac/
  • https://github.com/makesoftwaresafe/gpa…
  • Submit #816075 | GPAC MP4Box <= 2.4.0 (…
  • VDB-365629 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse ignored
  40 packages

  • msgpack-c
  • msgpack-cxx
  • gpac-unstable
  • msgpack-tools
  • rubyPackages.msgpack
  • phpExtensions.msgpack
  • haskellPackages.msgpack
  • perlPackages.MsgPackRaw
  • php82Extensions.msgpack
  • php83Extensions.msgpack
  • php84Extensions.msgpack
  • php85Extensions.msgpack
  • luaPackages.lua-cmsgpack
  • perl5Packages.MsgPackRaw
  • rubyPackages_3_3.msgpack
  • rubyPackages_3_4.msgpack
  • rubyPackages_4_0.msgpack
  • python312Packages.msgpack
  • python313Packages.msgpack
  • python314Packages.msgpack
  • lua51Packages.lua-cmsgpack
  • lua52Packages.lua-cmsgpack
  • lua53Packages.lua-cmsgpack
  • lua54Packages.lua-cmsgpack
  • lua55Packages.lua-cmsgpack
  • perl538Packages.MsgPackRaw
  • perl540Packages.MsgPackRaw
  • luajitPackages.lua-cmsgpack
  • python312Packages.ormsgpack
  • python313Packages.ormsgpack
  • python314Packages.ormsgpack
  • haskellPackages.data-msgpack
  • python312Packages.msgpack-numpy
  • python313Packages.msgpack-numpy
  • python314Packages.msgpack-numpy
  • haskellPackages.data-msgpack-types
  • python312Packages.u-msgpack-python
  • python313Packages.u-msgpack-python
  • python314Packages.u-msgpack-python
  • chickenPackages_5.chickenEggs.msgpack
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

GPAC MP4Box isom_intern.c MergeFragment null pointer dereference

• VDB-365629 | GPAC MP4Box isom_intern.c MergeFragment null pointer dereference technical-descriptionvdb-entry
• https://github.com/gpac/gpac/issues/3549 issue-tracking
• https://github.com/user-attachments/files/27196918/poc.zip exploit

Ignored references (4)

• VDB-365629 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• Submit #816075 | GPAC MP4Box <= 2.4.0 (master commit 7508ccc and earlier) Null pointer dereference (Denial of Service) third-party-advisory
• https://github.com/makesoftwaresafe/gpac/commit/525bf1af642c30af04e4df5345e6d79… patch
• https://github.com/gpac/gpac/ product

---

GPAC

• ==2.0
• ==2.2
• ==2.4.0
• ==2.3
• ==2.1

Patch: https://github.com/gpac/gpac/commit/525bf1af642c30af04e4df5345e6d798c0a4d8a1

NIXPKGS-2026-1733

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44708

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Mistune Math Plugin XSS Escape Bypass

• https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x x_refsource_CONFIRM
• https://github.com/lepture/mistune/releases/tag/v3.2.1 x_refsource_MISC

---

mistune

• ==< 3.2.1

NIXPKGS-2026-1732

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44898

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Mistune TOC Anchor Injection XSS

• https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv x_refsource_CONFIRM
• https://github.com/lepture/mistune/releases/tag/v3.2.1 x_refsource_MISC

---

mistune

• ==< 3.2.1

NIXPKGS-2026-1731

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44896

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Mistune: XSS via unescaped figclass/figwidth in Figure directive

• https://github.com/lepture/mistune/security/advisories/GHSA-58cw-g322-p94v x_refsource_CONFIRM

---

mistune

• ==<= 3.2.0

NIXPKGS-2026-1730

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-40034

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored reference VulnCheck… 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule

• GHSA Advisory GHSA-f26g-jm89-4g65 vendor-advisoryexploit
• https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0 patch
• https://github.com/GitoxideLabs/gitoxide/commit/dd5c18d9e526e8de462fa40aa047acd097cfa7dc patch
• Anthropic CVD Finding ANT-2026-6SNS6KMP third-party-advisory

Ignored references (1)

• VulnCheck Advisory: gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule third-party-advisory

---

gitoxide

• <0.82.0
• ==0.82.0

NIXPKGS-2026-1729

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-42496

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  6 packages

  • haskellPackages.archive-tar
  • perlPackages.ArchiveTarWrapper
  • perl540Packages.ArchiveTar
  • perl5Packages.ArchiveTarWrapper
  • perl538Packages.ArchiveTarWrapper
  • perl540Packages.ArchiveTarWrapper
  3 months, 2 weeks ago
• @LeSuisse restored package perl540Packages.ArchiveTar 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

• https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2ccc… patch
• https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes release-notes
• https://www.cve.org/CVERecord?id=CVE-2026-42497 related

---

Archive-Tar

• <3.08

NIXPKGS-2026-1728

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-45082

7.6 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Karakeep has a SSRF Protection Bypass via Redirect Handling

• https://github.com/karakeep-app/karakeep/security/advisories/GHSA-g647-327m-79g9 x_refsource_CONFIRMexploit

---

karakeep

• ==< 0.32.0

NIXPKGS-2026-1727

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-9605

5.5 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  3 references

  • https://www.gnu.org/
  • Submit #818197 | LibreDWG libredwg (inc…
  • VDB-365678 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow

• VDB-365678 | GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow technical-descriptionvdb-entry
• https://github.com/LibreDWG/libredwg/issues/1248 issue-tracking
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap… exploit
• https://github.com/LibreDWG/libredwg/commit/8f03865f37f5d4ffd616fef802acc980be5… patch

Ignored references (3)

• VDB-365678 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• Submit #818197 | LibreDWG libredwg (including the dwgbmp utility) 0.13.4.8160 Buffer Overflow third-party-advisory
• https://www.gnu.org/ productbroken-link

---

libredwg

• ==0.13.4.8160

NIXPKGS-2026-1726

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-41401

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored reference VulnCheck… 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

libyang - Heap Use-After-Free Write in XML Metadata Parsing

• GHSA Advisory GHSA-9f49-8x56-jmjc exploitvendor-advisory
• https://github.com/CESNET/libyang/commit/6b5ed47ee674fbe86b31bbebc4ff26889aeff38c patch
• Anthropic CVD Finding ANT-2026-TZQ1KH7E third-party-advisoryexploit

Ignored references (1)

• VulnCheck Advisory: libyang - Heap Use-After-Free Write in XML Metadata Parsing third-party-advisory

---

libyang

• ==5.4.3
• <5.4.3

NIXPKGS-2026-1725

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44775

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Kavita: No authentication at /api/Reader/image

• https://github.com/Kareadita/Kavita/security/advisories/GHSA-6gc9-6r8p-5wg2 x_refsource_CONFIRM
• https://github.com/Kareadita/Kavita/blob/8c686df2dbc2d0a83120e8b3f8c1269107bb815d/API/Controllers/ReaderController.cs#L116 x_refsource_MISC

---

Kavita

• ==< 0.9.0