NIXPKGS-2026-0986

GitHub issue published 2 months, 2 weeks ago

          Permalink
          
            CVE-2026-35406
          
        6.2 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          2 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          2 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          2 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          2 months, 2 weeks ago
          
            Aardvark-dns has incorrect error handling for malformed tcp packets
          
      https://github.com/containers/aardvark-dns/security/advisories/GHSA-hfpq-x728-986j
    
    x_refsource_CONFIRM
  
      https://github.com/containers/aardvark-dns/commit/3b49ea7b38bdea134b7f03256f2e13f44ce73bb1
    
    x_refsource_MISC
  
      https://github.com/containers/aardvark-dns/releases/tag/v1.17.1
    
    x_refsource_MISC
  
    aardvark-dns

            ==>= 1.16.0, < 1.17.1

NIXPKGS-2026-0985

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35517

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
5 packages
- swiftlint
- python312Packages.softlayer
- python313Packages.softlayer
- python314Packages.softlayer
- chickenPackages_5.chickenEggs.ftl
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

https://github.com/pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj x_refsource_CONFIRM

FTL

==>= 6.0, < 6.6

NIXPKGS-2026-0984

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35604

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
4 packages
- filebrowser-quantum
- python312Packages.filebrowser-safe
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

File Browser share links remain accessible after Share/Download permissions are revoked

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-v9w4-gm2x-6rvf x_refsource_CONFIRM
https://github.com/filebrowser/filebrowser/pull/5888 x_refsource_MISC

filebrowser

==< 2.63.1

NIXPKGS-2026-0983

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35458

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
3 packages
- python312Packages.gotenberg-client
- python313Packages.gotenberg-client
- python314Packages.gotenberg-client
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Gotenberg has a ReDoS via extraHttpHeaders scope feature

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fmwg-qcqh-m992 x_refsource_CONFIRM

gotenberg

==<= 8.29.1

NIXPKGS-2026-0982

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35607

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
4 packages
- filebrowser-quantum
- python312Packages.filebrowser-safe
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7526-j432-6ppp x_refsource_CONFIRM
https://github.com/filebrowser/filebrowser/pull/5890 x_refsource_MISC

filebrowser

==< 2.63.1

NIXPKGS-2026-0980

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-20911

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored package libraw1394 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality …

LibRaw

==Commit d20315b
==Commit 0b56545

Upstream patch: https://github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995

NIXPKGS-2026-0981

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35461

5.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL

https://github.com/papra-hq/papra/security/advisories/GHSA-cjw7-qg95-58mq x_refsource_CONFIRM

papra

==< 26.4.0

NIXPKGS-2026-0979

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-39363

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
7 packages
- vite
- vitess
- vitetris
- python312Packages.django-vite
- python313Packages.django-vite
- python314Packages.django-vite
- vscode-extensions.vitest.explorer
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583 x_refsource_CONFIRM

vite

==>= 6.0.0, < 6.4.2
==>= 8.0.0, < 8.0.5
==>= 7.0.0, < 7.3.2

vite-plus

==< 0.1.16

NIXPKGS-2026-0978

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35520

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse ignored
5 packages
- swiftlint
- python312Packages.softlayer
- python313Packages.softlayer
- python314Packages.softlayer
- chickenPackages_5.chickenEggs.ftl
2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

https://github.com/pi-hole/FTL/security/advisories/GHSA-fqv2-qhfh-ghcj x_refsource_CONFIRM

FTL

==>= 6.0, < 6.6

NIXPKGS-2026-0977

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35460

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 2 weeks ago
@LeSuisse accepted 2 months, 2 weeks ago
@LeSuisse published on GitHub 2 months, 2 weeks ago

Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name

https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4 x_refsource_CONFIRMexploit

papra

==< 26.4.0

Nixpkgs security tracker

Published issues

Aardvark-dns has incorrect error handling for malformed tcp packets

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

File Browser share links remain accessible after Share/Download permissions are revoked

Gotenberg has a ReDoS via extraHttpHeaders scope feature

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands

A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality …

Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection

Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name