NIXPKGS-2026-1036

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-3029

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  6 packages

  • python312Packages.pymupdf4llm
  • python313Packages.pymupdf4llm
  • python314Packages.pymupdf4llm
  • python312Packages.pymupdf-fonts
  • python313Packages.pymupdf-fonts
  • python314Packages.pymupdf-fonts
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

CVE-2026-3029

• http://github.com/pymupdf/PyMuPDF
• http://github.com/pymupdf/PyMuPDF/commit/603cafe38a183b8bab34f16d05043b4185d8d4…
• https://www.kb.cert.org/vuls/id/504749

---

PyMuPDF

• <1.26.7

NIXPKGS-2026-1035

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-39863

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Kamailio Core: TCP Data Processing Vulnerability

• https://github.com/kamailio/kamailio/security/advisories/GHSA-2wj4-f825-2h2f x_refsource_CONFIRM

---

kamailio

• ==< 5.8.8
• ==>= 6.0.0, < 6.0.6
• ==>= 6.1.0, < 6.1.1

NIXPKGS-2026-1034

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-39864

4.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Kamailio Auth: Processing Vulnerability For Additional Authenticated User Identity Checks

• https://github.com/kamailio/kamailio/security/advisories/GHSA-6m86-m342-g48m x_refsource_CONFIRM

---

kamailio

• ==>= 6.0.0, < 6.0.5
• ==< 5.8.7

NIXPKGS-2026-1033

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-34723

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  3 packages

  • python312Packages.zammad-py
  • python313Packages.zammad-py
  • python314Packages.zammad-py
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Zammad has incorrect access control in getting_started_controller

• https://github.com/zammad/zammad/security/advisories/GHSA-hcm9-ch62-5727 x_refsource_CONFIRM

---

zammad

• ==>= 7.0.0-alpha, < 7.0.1
• ==< 6.5.4

NIXPKGS-2026-1032

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-34248

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  3 packages

  • python312Packages.zammad-py
  • python313Packages.zammad-py
  • python314Packages.zammad-py
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Zammad has an information disclosure in ticket detail view of customers in shared organizations

• https://github.com/zammad/zammad/security/advisories/GHSA-prww-84vh-w978 x_refsource_CONFIRM

---

zammad

• ==>= 7.0.0, < 7.0.1

NIXPKGS-2026-1031

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-34722

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  3 packages

  • python312Packages.zammad-py
  • python313Packages.zammad-py
  • python314Packages.zammad-py
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Zammad is missing authorization in ticket create endpoint

• https://github.com/zammad/zammad/security/advisories/GHSA-28m3-wwgv-ppw8 x_refsource_CONFIRM

---

zammad

• ==>= 7.0.0-alpha, < 7.0.1
• ==< 6.5.4

NIXPKGS-2026-1030

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-34724

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  3 packages

  • python312Packages.zammad-py
  • python313Packages.zammad-py
  • python314Packages.zammad-py
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Zammad has a server-side template injection leading to RCE via AI Agent

• https://github.com/zammad/zammad/security/advisories/GHSA-fg9w-jg8f-4j94 x_refsource_CONFIRM

---

zammad

• ==>= 7.0.0, < 7.0.1

NIXPKGS-2026-1029

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-34721

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  3 packages

  • python312Packages.zammad-py
  • python313Packages.zammad-py
  • python314Packages.zammad-py
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Zammad has Cross-site request forgery (CSRF) in OAuth callback endpoints

• https://github.com/zammad/zammad/security/advisories/GHSA-mfwp-hx66-626c x_refsource_CONFIRM

---

zammad

• ==>= 7.0.0-alpha, < 7.0.1
• ==< 6.5.4

NIXPKGS-2026-1028

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-40026

4.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read

• Pull Request product
• Patch Commit patch

Ignored references (2)

• Mobasi Sentinel Vulnerability Index vendor-advisory
• VulnCheck Advisory: Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read third-party-advisory

---

sleuthkit

• ==a95b0ac21733b059a517aaefa667a17e1bcbdee1
• =<4.14.0

NIXPKGS-2026-1027

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-39844

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago
• @LeSuisse ignored
  3 packages

  • python312Packages.nicegui-highcharts
  • python313Packages.nicegui-highcharts
  • python314Packages.nicegui-highcharts
  2 months, 2 weeks ago

NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization

• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w8wv-vfpc-hw2w x_refsource_CONFIRM
• https://github.com/zauberzeug/nicegui/commit/d38a702e3af2da5b0708f689be8d71413fc77056 x_refsource_MISC
• https://github.com/zauberzeug/nicegui/releases/tag/v3.10.0 x_refsource_MISC

---

nicegui

• ==< 3.10.0