NIXPKGS-2026-1724

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-9538

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  5 packages

  • perl540Packages.ArchiveTarWrapper
  • perl538Packages.ArchiveTarWrapper
  • perl5Packages.ArchiveTarWrapper
  • perlPackages.ArchiveTarWrapper
  • haskellPackages.archive-tar
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header

• https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd362694… patch
• https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/05/26/4

---

Archive-Tar

• <3.10

NIXPKGS-2026-1723

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44831

4.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Snipe-IT: XSS vulnerability in component notes

• https://github.com/grokability/snipe-it/security/advisories/GHSA-r42m-953q-6vjx x_refsource_CONFIRM
• https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438 x_refsource_MISC

---

snipe-it

• ==< 8.4.1

NIXPKGS-2026-1721

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-47202

9.3 CRITICAL

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Kavita: Pre-Auth Account Takeover

• https://github.com/Kareadita/Kavita/security/advisories/GHSA-m2v3-fcjh-hm22 x_refsource_CONFIRM
• https://github.com/Kareadita/Kavita/releases/tag/v0.9.0.2 x_refsource_MISC

---

Kavita

• ==< 0.9.0.2

NIXPKGS-2026-1720

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-9530

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  3 references

  • VDB-365549 | CTI Indicators (IOB, IOC, …
  • Submit #814275 | LibreDWG Project Libre…
  • https://www.gnu.org/
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

GNU LibreDWG Dwgbmp Utility decode.c read_2004_compressed_section out-of-bounds

• VDB-365549 | GNU LibreDWG Dwgbmp Utility decode.c read_2004_compressed_section out-of-bounds technical-descriptionvdb-entry
• https://github.com/LibreDWG/libredwg/issues/1248 exploitissue-tracking
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap… exploit
• https://github.com/LibreDWG/libredwg/commit/8f03865f37f5d4ffd616fef802acc980be5… patch

Ignored references (3)

• VDB-365549 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• Submit #814275 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (2026-04-10) Out-of-bounds Read (CWE-125) third-party-advisory
• https://www.gnu.org/ product

---

LibreDWG

• ==0.12
• ==0.1
• ==0.13
• ==0.8
• ==0.7
• ==0.2
• ==0.6
• ==0.11
• ==0.10
• ==0.9
• ==0.5
• ==0.4
• ==0.14
• ==0.3

NIXPKGS-2026-1722

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-9519

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored reference VDB-36553… 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting

• VDB-365539 | stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting technical-descriptionvdb-entry
• Submit #814364 | stonith404 pingvin-share 1.13.0 DOM-Based XSS, Open Redirect third-party-advisory
• https://gist.github.com/TrebledJ/0efceef4f3a2e0515cc2fe96b4c22679 exploit

Ignored references (1)

• VDB-365539 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature

---

pingvin-share

• ==1.10
• ==1.11
• ==1.13.0
• ==1.1
• ==1.3
• ==1.5
• ==1.6
• ==1.8
• ==1.0
• ==1.4
• ==1.12
• ==1.7
• ==1.9
• ==1.2

NIXPKGS-2026-1719

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44832

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Snipe-IT: Privilege Escalation via API Permissions Assignment

• https://github.com/grokability/snipe-it/security/advisories/GHSA-hq28-crg7-95pr x_refsource_CONFIRM
• https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569 x_refsource_MISC

---

snipe-it

• ==< 8.4.1

NIXPKGS-2026-1718

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-8647

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available

• https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/changes release-notes
• https://metacpan.org/release/MIK/Crypt-ScryptKDF-0.011/diff/MIK/Crypt-ScryptKDF…

---

Crypt-ScryptKDF

• =<0.010

NIXPKGS-2026-1717

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-40033

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass

• GHSA Advisory GHSA-p6r2-4hgm-m6ff exploitvendor-advisory
• https://github.com/FreeRDP/FreeRDP/commit/23b36cd00ebf0ccd97750fcdbc9aa2f362352da7 patch
• VulnCheck Advisory: FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass third-party-advisory

---

FreeRDP

• ==3.26.0
• <3.26.0

NIXPKGS-2026-1716

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-44314

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  5 packages

  • python312Packages.pytraccar
  • python313Packages.pytraccar
  • python314Packages.pytraccar
  • home-assistant-component-tests.traccar
  • home-assistant-component-tests.traccar_server
  3 months, 2 weeks ago
• @LeSuisse ignored maintainer @frederictobiasc 3 months, 2 weeks ago maintainer.ignore
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

Traccar: Missing edit authorization on device image upload allows read-only users to write files

• https://github.com/traccar/traccar/security/advisories/GHSA-33v4-5x2g-7mjm x_refsource_CONFIRMexploit

---

traccar

• ==< 6.13.0

NIXPKGS-2026-1715

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-42448

3.5 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  8 packages

  • wormhole-rs
  • magic-wormhole-rs
  • python314Packages.magic-wormhole-mailbox-server
  • python313Packages.magic-wormhole-mailbox-server
  • python312Packages.magic-wormhole-mailbox-server
  • python314Packages.magic-wormhole-transit-relay
  • python313Packages.magic-wormhole-transit-relay
  • python312Packages.magic-wormhole-transit-relay
  3 months, 2 weeks ago
• @LeSuisse ignored maintainer @mjoerg 3 months, 2 weeks ago maintainer.ignore
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

wormhole receive, with --output pointing at an existing directory can be path-traversed

• https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-cf92-gfcw-6v53 x_refsource_CONFIRM

---

magic-wormhole

• ==< 0.24.0