Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-2479
published 45 minutes ago
Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change
Permalink CVE-2026-84203
8.6 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 45 minutes ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse accepted an hour ago
  • @LeSuisse published on GitHub 45 minutes ago

Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change

memos
  • =<0.30.0
NIXPKGS-2026-2478
published 45 minutes ago
Hugging Face Transformers library writes remote code to disk prior to consent check
Permalink CVE-2026-80047
updated 45 minutes ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse ignored
    33 packages
    • haskellPackages.has-transformers
    • haskellPackages.wai-transformers
    • python313Packages.x-transformers
    • python314Packages.x-transformers
    • haskellPackages.transformers-base
    • haskellPackages.transformers-abort
    • haskellPackages.aivika-transformers
    • haskellPackages.transformers-compat
    • haskellPackages.transformers-either
    • haskellPackages.transformers-except
    • haskellPackages.comonad-transformers
    • haskellPackages.indexed-transformers
    • python313Packages.spacy-transformers
    • python314Packages.spacy-transformers
    • pkgsRocm.python3Packages.transformers
    • haskellPackages.exception-transformers
    • haskellPackages.predicate-transformers
    • python313Packages.curated-transformers
    • python314Packages.curated-transformers
    • haskellPackages.writer-cps-transformers
    • pkgsRocm.python3Packages.x-transformers
    • python313Packages.sentence-transformers
    • python314Packages.sentence-transformers
    • haskellPackages.data-accessor-transformers
    • pkgsRocm.python3Packages.spacy-transformers
    • python313Packages.llm-sentence-transformers
    • python314Packages.llm-sentence-transformers
    • python313Packages.spacy-curated-transformers
    • python314Packages.spacy-curated-transformers
    • pkgsRocm.python3Packages.curated-transformers
    • pkgsRocm.python3Packages.sentence-transformers
    • pkgsRocm.python3Packages.llm-sentence-transformers
    • pkgsRocm.python3Packages.spacy-curated-transformers
    59 minutes ago
  • @LeSuisse accepted 59 minutes ago
  • @LeSuisse published on GitHub 45 minutes ago

Hugging Face Transformers library writes remote code to disk prior to consent check

Transformers
  • =<5.8.1 
Needs a backport/bump on stable
NIXPKGS-2026-2477
published 46 minutes ago
Wyoming < 1.10.2 SSRF via uri Query Parameter
Permalink CVE-2026-8712
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): Low (L)
  • Subsequent System Impact Availability (SA): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Low (L)
  • Modified Subsequent System Impact Availability (MSA): Low (L)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 46 minutes ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse ignored
    6 packages
    • pkgsRocm.wyoming-faster-whisper
    • wyoming-piper
    • wyoming-satellite
    • wyoming-openwakeword
    • pkgsRocm.wyoming-piper
    • wyoming-faster-whisper
    58 minutes ago
  • @LeSuisse accepted 57 minutes ago
  • @LeSuisse published on GitHub 46 minutes ago

Wyoming < 1.10.2 SSRF via uri Query Parameter

wyoming
  • <1.10.2 
Needs some backports on stable
NIXPKGS-2026-2476
published 46 minutes ago
Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
Permalink CVE-2026-84206
5.3 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 46 minutes ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse accepted 56 minutes ago
  • @LeSuisse published on GitHub 46 minutes ago

Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

snipe-it
  • <8.7.0
  • ==8.7.0
NIXPKGS-2026-2475
published 46 minutes ago
Popt-devel: popt-static: short realloc in poptconfigfiletostring
Permalink CVE-2026-18743
2.5 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 46 minutes ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse ignored
    12 packages
    • ipopt
    • poptop
    • poptracker
    • scipopt-ug
    • scipopt-gcg
    • scipopt-scip
    • scipopt-zimpl
    • scipopt-papilo
    • scipopt-soplex
    • pkgsRocm.scipopt-ug
    • python313Packages.cyipopt
    • python314Packages.cyipopt
    50 minutes ago
  • @LeSuisse accepted 50 minutes ago
  • @LeSuisse published on GitHub 46 minutes ago

Popt-devel: popt-static: short realloc in poptconfigfiletostring

popt
  • *
openshift/ose-rhel-coreos-8
openshift/ose-rhel-coreos-9
NIXPKGS-2026-2474
published 46 minutes ago
ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading
Permalink CVE-2026-84202
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 46 minutes ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse ignored
    2 packages
    • python313Packages.modelscope-hub
    • python314Packages.modelscope-hub
    50 minutes ago
  • @LeSuisse accepted 50 minutes ago
  • @LeSuisse published on GitHub 46 minutes ago

ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

modelscope
  • =<1.40.0
NIXPKGS-2026-2473
published 46 minutes ago
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Permalink CVE-2026-84305
5.1 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 46 minutes ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse accepted 46 minutes ago
  • @LeSuisse published on GitHub 46 minutes ago

sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

sqlparse
  • ==< 0.6.0
NIXPKGS-2026-2472
published 47 minutes ago
gvfs: security issues < 1.61.90
Permalink CVE-2026-84269
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 47 minutes ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse ignored package yaziPlugins.gvfs 48 minutes ago
  • @LeSuisse accepted 48 minutes ago
  • @LeSuisse published on GitHub 47 minutes ago

Gvfs: afp: heap-based buffer overflow in dsi read path

gvfs
Fixed in 1.61.90

https://gitlab.gnome.org/GNOME/gvfs/-/commit/072a7e02d11f5b7dfa324b70dd0e16d60f9b9e60
Permalink CVE-2026-84268
8.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 47 minutes ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse ignored package yaziPlugins.gvfs an hour ago
  • @LeSuisse accepted an hour ago
  • @LeSuisse published on GitHub 47 minutes ago

Gvfs: sftp: heap-based buffer overflow in read_reply()

gvfs
Fixed in 1.61.90

https://gitlab.gnome.org/GNOME/gvfs/-/commit/5ab77256f9c071c7c99a5298db1729cf143bff05
Permalink CVE-2026-84267
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 47 minutes ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse ignored package yaziPlugins.gvfs 49 minutes ago
  • @LeSuisse accepted 48 minutes ago
  • @LeSuisse published on GitHub 47 minutes ago

Gvfs: sftp: uninitialized heap disclosure in read_string()

gvfs
Fixed in 1.61.90

https://gitlab.gnome.org/GNOME/gvfs/-/commit/d9a59b8e385189b4783d9b66ca475f530fb26693
Permalink CVE-2026-84270
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Physical (P)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Physical (P)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 47 minutes ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse ignored package yaziPlugins.gvfs 48 minutes ago
  • @LeSuisse accepted 47 minutes ago
  • @LeSuisse published on GitHub 47 minutes ago

Gvfs: mtp: out-of-bounds read in do_read()

gvfs
Fixed in 1.61.90

https://gitlab.gnome.org/GNOME/gvfs/-/commit/070e5e4223c97f7e793a342ba6e64df1095ccb0d
NIXPKGS-2026-2471
published an hour ago
librenms: security issues < 26.7.0 (backport needed)
Permalink CVE-2026-84189
9.2 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): High (H)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): High (H)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated an hour ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse accepted an hour ago
  • @LeSuisse published on GitHub an hour ago

LibreNMS before 26.7.0 Stored XSS via Oxidized API

librenms
  • <26.7.0
  • ==26.7.0 
Needs some backport to stable
Permalink CVE-2026-84188
4.8 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): Low (L)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Low (L)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated an hour ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse accepted an hour ago
  • @LeSuisse published on GitHub an hour ago

librenms before 26.7.0 Stored XSS via graph_descr settings

librenms
  • <26.7.0
  • ==26.7.0 
Needs some backport to stable
NIXPKGS-2026-2470
published an hour ago
svgo: security issues < 4.1.0
Permalink CVE-2026-84369
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated an hour ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse ignored package haskellPackages.svgone an hour ago
  • @LeSuisse accepted an hour ago
  • @LeSuisse published on GitHub an hour ago

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

svgo
  • ==>= 3.0.0, < 3.3.5
  • ==>= 1.0.0, < 2.8.4
  • ==>= 4.0.0, < 4.1.0
Permalink CVE-2026-84370
8.2 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated an hour ago by @LeSuisse Activity log
  • Created suggestion 7 hours ago
  • @LeSuisse ignored package haskellPackages.svgone an hour ago
  • @LeSuisse accepted an hour ago
  • @LeSuisse published on GitHub an hour ago

SVGO: removeScripts allows executable links through namespace and control-character bypasses

svgo
  • ==>= 3.0.0, < 3.3.5
  • ==>= 1.0.0, < 2.8.4
  • ==>= 4.0.0, < 4.1.0
Permalink CVE-2026-73650
8.2 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated an hour ago by @LeSuisse Activity log
  • Created suggestion 2 weeks, 5 days ago
  • @LeSuisse accepted an hour ago
  • @LeSuisse ignored package haskellPackages.svgone an hour ago
  • @LeSuisse published on GitHub an hour ago

SVGO: removeScripts plugin leaves some executable scripts intact

svgo
  • ==>= 3.0.0, < 3.3.4
  • ==>= 1.0.0, < 2.8.3
  • ==>= 4.0.0, < 4.0.2