NIXPKGS-2026-1096

GitHub issue published 2 months, 1 week ago

          Permalink
          
            CVE-2026-33901
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          2 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
                3 packages
                graphicsmagick-imagemagick-compat
tests.pkg-config.defaultPkgConfigPackages.MagickWand
tests.pkg-config.defaultPkgConfigPackages.ImageMagick

          2 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          2 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          2 months, 1 week ago
          
            ImageMagick has a Heap Buffer Overflow via MVG decoder
          
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x9h5-r9v2-vcww
    
    x_refsource_CONFIRM
  
      https://github.com/ImageMagick/ImageMagick/commit/4c72003e9e54a4ebaa938d239e75f5d285527ebe
    
    x_refsource_MISC
  
          Ignored references (1)
        
      https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0
    
    x_refsource_MISC
  
    ImageMagick

            ==< 6.9.13-44
          
            ==< 7.1.2-19

NIXPKGS-2026-1094

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-4151

updated 2 months, 1 week ago by @LeSuisse Activity log

Created suggestion 2 months, 1 week ago
@LeSuisse ignored
18 packages
- zigimports
- gimpPlugins.gimp
- gimpPlugins.gmic
- gimp-with-plugins
- gimp2Plugins.bimp
- gimp2Plugins.gimp
- gimp2Plugins.gmic
- gimp2-with-plugins
- gimp3-with-plugins
- gimp2Plugins.fourier
- gimp2Plugins.farbfeld
- gimpPlugins.lightning
- gimp2Plugins.lightning
- gimp2Plugins.lqrPlugin
- gimp2Plugins.texturize
- gimp2Plugins.gimplensfun
- gimpPlugins.resynthesizer
- gimp2Plugins.waveletSharpen
2 months, 1 week ago
@LeSuisse accepted 2 months, 1 week ago
@LeSuisse published on GitHub 2 months, 1 week ago

GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI-26-218 x_research-advisory
vendor-provided URL vendor-advisory

GIMP

==3.0.8

NIXPKGS-2026-1095

GitHub issue published 2 months, 1 week ago

          Permalink
          
            CVE-2026-6192
          
        3.3 LOW
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): Low (L)
        
          Exploit Code Maturity (E): Proof-of-Concept (P)
        
          Remediation Level (RL): Official Fix (O)
        
          Report Confidence (RC): Confirmed (C)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          2 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
                3 packages
                python312Packages.pylibjpeg-openjpeg
python313Packages.pylibjpeg-openjpeg
python314Packages.pylibjpeg-openjpeg

          2 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          2 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          2 months, 1 week ago
          
            uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow
          
      https://github.com/uclouvain/openjpeg/issues/1619
    
    issue-trackingexploit
  
      https://github.com/uclouvain/openjpeg/pull/1628
    
    issue-trackingpatch
  
      https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65…
    
    patch
  
          Ignored references (4)
        
      VDB-357114 | uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow
    
    technical-descriptionvdb-entry
  
      VDB-357114 | CTI Indicators (IOB, IOC, IOA)
    
    permissions-requiredsignature
  
      Submit #797385 | uclouvain openjpeg 2.5.4 Integer Overflow
    
    third-party-advisory
  
      https://github.com/uclouvain/openjpeg/
    
    product
  
    openjpeg

            ==2.5.3
          
            ==2.5.4
          
            ==2.5.0
          
            ==2.5.1
          
            ==2.5.2

NIXPKGS-2026-1093

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-6204

updated 2 months, 1 week ago by @LeSuisse Activity log

Created suggestion 2 months, 1 week ago
@LeSuisse accepted 2 months, 1 week ago
@LeSuisse published on GitHub 2 months, 1 week ago

LibreNMS versions before 26.3.0 are affected by an authenticated remote …

librenms

<26.3.0

NIXPKGS-2026-1092

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-4153

updated 2 months, 1 week ago by @LeSuisse Activity log

Created suggestion 2 months, 1 week ago
@LeSuisse ignored
18 packages
- zigimports
- gimpPlugins.gimp
- gimpPlugins.gmic
- gimp-with-plugins
- gimp2Plugins.bimp
- gimp2Plugins.gimp
- gimp2Plugins.gmic
- gimp2-with-plugins
- gimp3-with-plugins
- gimp2Plugins.fourier
- gimp2Plugins.farbfeld
- gimpPlugins.lightning
- gimp2Plugins.lightning
- gimp2Plugins.lqrPlugin
- gimp2Plugins.texturize
- gimp2Plugins.gimplensfun
- gimpPlugins.resynthesizer
- gimp2Plugins.waveletSharpen
2 months, 1 week ago
@LeSuisse accepted 2 months, 1 week ago
@LeSuisse published on GitHub 2 months, 1 week ago

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-26-220 x_research-advisory
vendor-provided URL vendor-advisory

GIMP

==3.0.8

NIXPKGS-2026-1091

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-4154

updated 2 months, 1 week ago by @LeSuisse Activity log

Created suggestion 2 months, 1 week ago
@LeSuisse ignored
18 packages
- zigimports
- gimpPlugins.gimp
- gimpPlugins.gmic
- gimp-with-plugins
- gimp2Plugins.bimp
- gimp2Plugins.gimp
- gimp2Plugins.gmic
- gimp2-with-plugins
- gimp3-with-plugins
- gimp2Plugins.fourier
- gimp2Plugins.farbfeld
- gimpPlugins.lightning
- gimp2Plugins.lightning
- gimp2Plugins.lqrPlugin
- gimp2Plugins.texturize
- gimp2Plugins.gimplensfun
- gimpPlugins.resynthesizer
- gimp2Plugins.waveletSharpen
2 months, 1 week ago
@LeSuisse accepted 2 months, 1 week ago
@LeSuisse published on GitHub 2 months, 1 week ago

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability

ZDI-26-221 x_research-advisory
vendor-provided URL vendor-advisory

GIMP

==3.0.8

NIXPKGS-2026-1090

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-32316

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 2 months, 1 week ago by @LeSuisse Activity log

Created suggestion 2 months, 1 week ago
@LeSuisse ignored
38 packages
- ijq
- jql
- jqp
- njq
- gojq
- jqfmt
- jq-lsp
- jquake
- jq-zsh-plugin
- python312Packages.jq
- python313Packages.jq
- python314Packages.jq
- python312Packages.llm-jq
- python313Packages.llm-jq
- python314Packages.llm-jq
- haskellPackages.js-jquery
- tests.fetchpatch.relative
- python312Packages.xstatic-jquery
- python313Packages.xstatic-jquery
- python314Packages.xstatic-jquery
- python312Packages.django-jquery-js
- python313Packages.django-jquery-js
- python314Packages.django-jquery-js
- python312Packages.xstatic-jquery-ui
- python313Packages.xstatic-jquery-ui
- python314Packages.xstatic-jquery-ui
- tree-sitter-grammars.tree-sitter-jq
- tests.fetchNextcloudApp.simple-sha512
- vimPlugins.nvim-treesitter-parsers.jq
- python312Packages.sphinxcontrib-jquery
- python313Packages.sphinxcontrib-jquery
- python314Packages.sphinxcontrib-jquery
- tests.fetchFromGitHub.submodule-leave-git
- python312Packages.xstatic-jquery-file-upload
- python313Packages.xstatic-jquery-file-upload
- python314Packages.xstatic-jquery-file-upload
- python313Packages.tree-sitter-grammars.tree-sitter-jq
- python314Packages.tree-sitter-grammars.tree-sitter-jq
2 months, 1 week ago
@LeSuisse accepted 2 months, 1 week ago
@LeSuisse published on GitHub 2 months, 1 week ago

jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow

https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f x_refsource_CONFIRM
https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5 x_refsource_MISC

jq

==< e47e56d226519635768e6aab2f38f0ab037c09e5

NIXPKGS-2026-1088

GitHub issue published 2 months, 1 week ago

Permalink CVE-2025-66236

updated 2 months, 1 week ago by @LeSuisse Activity log

Created suggestion 2 months, 1 week ago
@LeSuisse accepted 2 months, 1 week ago
@LeSuisse published on GitHub 2 months, 1 week ago

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

apache-airflow

<3.2.0

NIXPKGS-2026-1089

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-5054

updated 2 months, 1 week ago by @LeSuisse Activity log

Created suggestion 2 months, 1 week ago
@LeSuisse accepted 2 months, 1 week ago
@LeSuisse published on GitHub 2 months, 1 week ago

NoMachine External Control of File Path Local Privilege Escalation Vulnerability

ZDI-26-248 x_research-advisory

NoMachine

==9.3.7

https://kb.nomachine.com/SU03X00271

NIXPKGS-2026-1087

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-4152

updated 2 months, 1 week ago by @LeSuisse Activity log

Created suggestion 2 months, 1 week ago
@LeSuisse ignored
18 packages
- zigimports
- gimpPlugins.gimp
- gimpPlugins.gmic
- gimp-with-plugins
- gimp2Plugins.bimp
- gimp2Plugins.gimp
- gimp2Plugins.gmic
- gimp2-with-plugins
- gimp3-with-plugins
- gimp2Plugins.fourier
- gimp2Plugins.farbfeld
- gimpPlugins.lightning
- gimp2Plugins.lightning
- gimp2Plugins.lqrPlugin
- gimp2Plugins.texturize
- gimp2Plugins.gimplensfun
- gimpPlugins.resynthesizer
- gimp2Plugins.waveletSharpen
2 months, 1 week ago
@LeSuisse accepted 2 months, 1 week ago
@LeSuisse published on GitHub 2 months, 1 week ago

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ZDI-26-219 x_research-advisory
vendor-provided URL vendor-advisory

GIMP

==3.0.8

Nixpkgs security tracker

Published issues

ImageMagick has a Heap Buffer Overflow via MVG decoder

GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability

uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow

LibreNMS versions before 26.3.0 are affected by an authenticated remote …

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability

jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

NoMachine External Control of File Path Local Privilege Escalation Vulnerability

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability