⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Dismissed suggestions

These automatic suggestions were dismissed after initial triaging.

Restore to select a suggestion for a revision.

CVE-2023-1786
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 2 months, 3 weeks ago by @fricklerhandwerk Activity log
  • Created automatic suggestion 2 months, 4 weeks ago
  • @fricklerhandwerk dismissed 2 months, 3 weeks ago
sensitive data exposure in cloud-init logs

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.

cloud-init
<23.1.2

pkgs.cloud-init

Provides configuration and customization of cloud instance
Notify package maintainers: 2
CVE-2020-11936
3.1 LOW
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 2 months, 3 weeks ago by @fricklerhandwerk Activity log
  • Created automatic suggestion 2 months, 4 weeks ago
  • @fricklerhandwerk dismissed 2 months, 3 weeks ago
gdbus setgid privilege escalation

gdbus setgid privilege escalation

apport
<2.20.11-0ubuntu27.6

pkgs.texlivePackages.skrapport

'Simple' class for reports, etc.
Notify package maintainers: 1
CVE-2023-0092
4.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 2 months, 3 weeks ago by @fricklerhandwerk Activity log
  • Created automatic suggestion 2 months, 4 weeks ago
  • @fricklerhandwerk removed
    4 packages
    • pkgs.jujutsu 0.17.1
    • pkgs.jujutsu 0.23.0
    • pkgs.jujutsu 0.24.0
    • pkgs.jujuutils 0.2
    2 months, 3 weeks ago
  • @fricklerhandwerk dismissed 2 months, 3 weeks ago
An authenticated user who has read access to the juju …

An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.

juju
<2.9.38
<3.0.3
Notify package maintainers: 1
CVE-2022-28653
updated 2 months, 3 weeks ago by @fricklerhandwerk Activity log
  • Created automatic suggestion 2 months, 4 weeks ago
  • @fricklerhandwerk dismissed 2 months, 3 weeks ago
Users can consume unlimited disk space in /var/crash

Users can consume unlimited disk space in /var/crash

apport
<2.21.0

pkgs.texlivePackages.skrapport

'Simple' class for reports, etc.
Notify package maintainers: 1
CVE-2025-23684
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 3 months ago by @fricklerhandwerk Activity log
  • Created automatic suggestion 3 months ago
  • @fricklerhandwerk dismissed 3 months ago
WordPress Debug Tool plugin <= 2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Eugen Bobrowski Debug Tool allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Debug Tool: from n/a through 2.2.

debug-tool
=<2.2

pkgs.python311Packages.django-debug-toolbar

Configurable set of panels that display debug information about the current request/response

pkgs.python312Packages.django-debug-toolbar

Configurable set of panels that display debug information about the current request/response

pkgs.python312Packages.django-graphiql-debug-toolbar

Django Debug Toolbar for GraphiQL IDE
Notify package maintainers: 2
CVE-2025-23886
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 3 months, 1 week ago by @Erethon Activity log
  • Created automatic suggestion 3 months, 1 week ago
  • @Erethon accepted as draft 3 months, 1 week ago
  • @Erethon dismissed 3 months, 1 week ago
WordPress Annie plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Roberts Annie allows Stored XSS.This issue affects Annie: from n/a through 2.1.1.

annie
=<2.1.1
Notify package maintainers: 1
CVE-2025-23892
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 3 months, 1 week ago by @Erethon Activity log
  • Created automatic suggestion 3 months, 1 week ago
  • @Erethon accepted as draft 3 months, 1 week ago
  • @Erethon dismissed 3 months, 1 week ago
WordPress Progress Tracker plugin <= 0.9.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Furr and Simon Ward Progress Tracker allows DOM-Based XSS.This issue affects Progress Tracker: from n/a through 0.9.3.

progress-tracker
=<0.9.3

pkgs.progress-tracker

Simple kanban-style task organiser
Notify package maintainers: 1
CVE-2022-45836
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 3 months, 1 week ago by @Erethon Activity log
  • Created automatic suggestion 3 months, 2 weeks ago
  • @Erethon accepted as draft 3 months, 1 week ago
  • @Erethon dismissed 3 months, 1 week ago
  • @Erethon accepted as draft 3 months, 1 week ago
  • @Erethon dismissed 3 months, 1 week ago
WordPress Download Manager Plugin <= 3.2.59 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in W3 Eden, Inc. Download Manager plugin <= 3.2.59 versions.

download-manager
=<3.2.59
Notify package maintainers: 1
CVE-2014-125026
updated 3 months, 4 weeks ago by @arianvp Activity log
  • Created automatic suggestion 4 months, 2 weeks ago
  • @LeSuisse dismissed 4 months, 2 weeks ago
  • @arianvp accepted as draft 3 months, 4 weeks ago
  • @arianvp dismissed 3 months, 4 weeks ago
Out-of-bounds write in github.com/cloudflare/golz4

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

github.com/cloudflare/golz4
<0.0.0-20140711154735-199f5f787806
CVE-2013-10005
updated 4 months, 2 weeks ago by @LeSuisse Activity log
  • Created automatic suggestion 4 months, 2 weeks ago
  • @LeSuisse dismissed 4 months, 2 weeks ago
Infinite loop in github.com/btcsuite/go-socks

The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow.

github.com/btcsuite/go-socks
<0.0.0-20130808000456-233bccbb1abe
github.com/btcsuitereleases/go-socks
<0.0.0-20130808000456-233bccbb1abe