NIXPKGS-2026-2228

GitHub issue published 1 week, 1 day ago

Excon: redact additional sensitive/risky headers when following redirects

Permalink CVE-2026-54171

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Excon: redact additional sensitive/risky headers when following redirects

• https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r x_refsource_CONFIRM
• https://github.com/excon/excon/pull/901 x_refsource_MISC
• https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3 x_refsource_MISC

---

excon

• ==< 1.5.0

NIXPKGS-2026-2227

GitHub issue published 1 week, 1 day ago

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison

Permalink CVE-2026-9537

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison

• https://github.com/jberger/Mojo-JWT/commit/b8aefb846613e44b5b12bc170898ffd5b050… patch
• http://www.openwall.com/lists/oss-security/2026/07/17/11

---

Mojo-JWT

• <1.02

NIXPKGS-2026-2226

GitHub issue published 1 week, 1 day ago

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets

Permalink CVE-2026-13082

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets

• https://www.cve.org/CVERecord?id=CVE-2025-40916 related
• https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1… patch

---

GD-SecurityImage

• =<1.75

NIXPKGS-2026-2225

GitHub issue published 1 week, 1 day ago

AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

Permalink CVE-2026-45309

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

• https://github.com/ronf/asyncssh/security/advisories/GHSA-g794-3fmp-753h x_refsource_CONFIRM
• https://github.com/ronf/asyncssh/commit/2af2382cce946c959a378a62f257af253dc4ab51 x_refsource_MISC
• https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88 x_refsource_MISC

---

asyncssh

• ==< 2.23.0

NIXPKGS-2026-2224

GitHub issue published 1 week, 1 day ago

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date

Permalink CVE-2026-14741

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse ignored package haskellPackages.http-date 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date

• https://github.com/libwww-perl/HTTP-Date/commit/78c20952cdfbf11e03cf1199ad70f13… patch
• https://github.com/libwww-perl/HTTP-Date/pull/33 issue-tracking
• https://metacpan.org/release/OALDERS/HTTP-Date-6.08/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/07/17/10

---

HTTP-Date

• <6.08

NIXPKGS-2026-2223

GitHub issue published 1 week, 1 day ago

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

Permalink CVE-2026-46377

6.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

• https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq exploitx_refsource_CONFIRM
• https://github.com/TomWright/dasel/commit/5fc1172287df89860caf139b146007d7ed12178c x_refsource_MISC
• https://github.com/TomWright/dasel/releases/tag/v3.10.1 x_refsource_MISC

---

dasel

• ==>= 3.0.0, < 3.10.1

NIXPKGS-2026-2222

GitHub issue published 1 week, 1 day ago

zrok copy writes attacker-controlled WebDAV paths outside the destination root

Permalink CVE-2026-45576

8.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

zrok copy writes attacker-controlled WebDAV paths outside the destination root

• https://github.com/openziti/zrok/security/advisories/GHSA-c656-jcx2-7pqj x_refsource_CONFIRM
• https://github.com/openziti/zrok/commit/a5811e61589d2f804267c6de4a9056db1bdea457 x_refsource_MISC
• https://github.com/openziti/zrok/releases/tag/v2.0.3 x_refsource_MISC

---

zrok

• ==>= 0.4.23, < 2.0.3

NIXPKGS-2026-2221

GitHub issue published 1 week, 1 day ago

Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

Permalink CVE-2026-48863

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

• https://access.redhat.com/security/cve/CVE-2026-48863 x_refsource_REDHATvdb-entry
• RHBZ#2460975 issue-trackingx_refsource_REDHAT
• https://github.com/openSUSE/libsolv/commit/44f8c085045b1f771641091bbb2b810d12cf…
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48863.json x_sadp-csaf-vex

---

rhcos

libsolv

• <0.7.38

satellite-capsule:el8/libsolv

NIXPKGS-2026-2220

GitHub issue published 1 week, 1 day ago

PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

Permalink CVE-2026-46338

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h x_refsource_CONFIRM
• https://github.com/facelessuser/pymdown-extensions/commit/63b7835776d703d6c339cf2110d9888f676efc0c x_refsource_MISC
• https://github.com/facelessuser/pymdown-extensions/releases/tag/10.21.3 x_refsource_MISC

---

pymdown-extensions

• ==>= 10.0.1, < 10.21.3

Needs a backport

NIXPKGS-2026-2219

GitHub issue published 1 week, 1 day ago

Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint

Permalink CVE-2026-63087

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 1 day ago
• @LeSuisse ignored
  3 packages

  • python314Packages.volvooncall
  • python313Packages.volvooncall
  • oncall
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint

• Researcher Disclosure technical-descriptionexploit
• https://www.vulncheck.com/advisories/grafana-oncall-unauthenticated-token-hijac… third-party-advisory

---

oncall

• =<1.16.11

Needs to be tagged with knownVulnerabilities, archived upstream.