NIXPKGS-2026-1704

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-9064

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 3 weeks ago
• @LeSuisse published on GitHub 3 months, 3 weeks ago

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

• https://access.redhat.com/security/cve/CVE-2026-9064 x_refsource_REDHATvdb-entry
• RHBZ#2480093 x_refsource_REDHATissue-tracking

---

389-ds-base

389-ds:1.4/389-ds-base

redhat-ds:11/389-ds-base

redhat-ds:12/389-ds-base

NIXPKGS-2026-1703

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-40165

8.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse ignored
  3 packages

  • authentik-outposts.ldap
  • authentik-outposts.proxy
  • authentik-outposts.radius
  3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 3 weeks ago
• @LeSuisse published on GitHub 3 months, 3 weeks ago

authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation

• https://github.com/goauthentik/authentik/security/advisories/GHSA-9wj8-xv4r-qwrp x_refsource_CONFIRM
• https://github.com/goauthentik/authentik/commit/47dec5c6b7fb4a62bfad2ae8bddf002bde7ba774 x_refsource_MISC
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.5 x_refsource_MISC

---

authentik

• ==< 2025.12.5
• ==>= 2026.2.0-rc1, < 2026.2.3

NIXPKGS-2026-1702

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-26028

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 3 weeks ago
• @LeSuisse published on GitHub 3 months, 3 weeks ago

CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS

• https://github.com/cryptpad/cryptpad/security/advisories/GHSA-g2g4-47gv-p72v x_refsource_CONFIRM
• https://github.com/cryptpad/cryptpad/releases/tag/2026.2.0 x_refsource_MISC

---

cryptpad

• ==< 2026.2.0

NIXPKGS-2026-1701

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-9149

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 3 weeks ago
• @LeSuisse published on GitHub 3 months, 3 weeks ago

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

• https://access.redhat.com/security/cve/CVE-2026-9149 x_refsource_REDHATvdb-entry
• RHBZ#2460380 x_refsource_REDHATissue-tracking
• https://github.com/openSUSE/libsolv/pull/617

---

rhcos

libsolv

satellite-capsule:el8/libsolv

Patch: https://github.com/openSUSE/libsolv/commit/210386037c892a720972ad35a3d8f7073b4d763b

NIXPKGS-2026-1700

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-32739

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 3 weeks ago
• @LeSuisse published on GitHub 3 months, 3 weeks ago

libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup

• https://github.com/strukturag/libheif/security/advisories/GHSA-j9g7-q9hv-gq8c x_refsource_CONFIRM
• https://github.com/strukturag/libheif/releases/tag/v1.22.0 x_refsource_MISC

---

libheif

• ==< 1.22.0

NIXPKGS-2026-1698

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-32814

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 3 weeks ago
• @LeSuisse published on GitHub 3 months, 3 weeks ago

libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles

• https://github.com/strukturag/libheif/security/advisories/GHSA-4m8r-34pg-rvwc x_refsource_CONFIRM
• https://github.com/strukturag/libheif/releases/tag/v1.22.0 x_refsource_MISC

---

libheif

• ==< 1.22.0

NIXPKGS-2026-1697

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-32741

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 3 weeks ago
• @LeSuisse published on GitHub 3 months, 3 weeks ago

libheif has a heap buffer overflow in decode_mask_image()

• https://github.com/strukturag/libheif/security/advisories/GHSA-j3w5-7whq-p37q x_refsource_CONFIRM
• https://github.com/strukturag/libheif/releases/tag/v1.22.0 x_refsource_MISC

---

libheif

• ==< 1.22.0

NIXPKGS-2026-1699

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-32740

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 3 weeks ago
• @LeSuisse published on GitHub 3 months, 3 weeks ago

libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing

• https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j x_refsource_CONFIRM
• https://github.com/strukturag/libheif/releases/tag/v1.22.0 x_refsource_MISC

---

libheif

• ==< 1.22.0

NIXPKGS-2026-1696

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-32738

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 3 weeks ago
• @LeSuisse published on GitHub 3 months, 3 weeks ago

libheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk

• https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww x_refsource_CONFIRMexploit

---

libheif

• ==< 1.22.0

NIXPKGS-2026-1695

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-32882

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 3 weeks ago
• @LeSuisse published on GitHub 3 months, 3 weeks ago

libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride

• https://github.com/strukturag/libheif/security/advisories/GHSA-hg7q-rjr2-8x46 x_refsource_CONFIRM
• https://github.com/strukturag/libheif/releases/tag/v1.22.0 x_refsource_MISC

---

libheif

• ==< 1.22.0