NIXPKGS-2026-1424

GitHub issue published 4 months, 1 week ago

          Permalink
          
            CVE-2026-40243
          
              updated
            
          4 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
                3 packages
                incus-ui-canonical
terraform-providers.incus
terraform-providers.lxc_incus

          4 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          4 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months, 1 week ago
          
            Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation
          
      https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3
    
    x_refsource_CONFIRM
  
      https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icnb.go
    
    x_refsource_MISC
  
      https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_icsb.go
    
    x_refsource_MISC
  
      https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_nb.go
    
    x_refsource_MISC
  
      https://github.com/lxc/incus/blob/v6.22.0/internal/server/network/ovn/ovn_sb.go
    
    x_refsource_MISC
  
    incus

            ==< 7.0.0

NIXPKGS-2026-1423

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-40171

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
29 packages
- rednotebook
- wolfram-notebook
- python312Packages.notebook-shim
- python313Packages.notebook-shim
- python314Packages.notebook-shim
- python312Packages.jupyterlab-vim
- python312Packages.jupyterlab-lsp
- python312Packages.jupyterlab-git
- python313Packages.jupyterlab-git
- python313Packages.jupyterlab-lsp
- python313Packages.jupyterlab-vim
- python314Packages.jupyterlab-git
- python314Packages.jupyterlab-lsp
- python314Packages.jupyterlab-vim
- python312Packages.pytest-notebook
- python313Packages.pytest-notebook
- python314Packages.pytest-notebook
- python312Packages.jupyterlab-server
- python313Packages.jupyterlab-server
- python314Packages.jupyterlab-server
- python312Packages.jupyterlab-widgets
- python313Packages.jupyterlab-widgets
- python314Packages.jupyterlab-widgets
- python312Packages.jupyterlab-pygments
- python313Packages.jupyterlab-pygments
- python314Packages.jupyterlab-pygments
- python312Packages.jupyterlab-execute-time
- python313Packages.jupyterlab-execute-time
- python314Packages.jupyterlab-execute-time
4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker

https://github.com/jupyter/notebook/security/advisories/GHSA-rch3-82jr-f9w9 x_refsource_CONFIRM

notebook

==>=7.0.0, <= 7.5.5

jupyterlab

==<= 4.5.6

help-extension

==<=4.5.6
==>=7.0.0,<= 7.5.5

NIXPKGS-2026-1422

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-23928

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
52 packages
- zabbixctl
- zabbix-cli
- zabbix.agent
- zabbix.agent2
- zabbix.server
- zabbix60.agent
- zabbix70.agent
- zabbix72.agent
- zabbix74.agent
- zabbix60.agent2
- zabbix60.server
- zabbix70.agent2
- zabbix70.server
- zabbix72.agent2
- zabbix72.server
- zabbix74.agent2
- zabbix74.server
- zabbix.proxy-mysql
- zabbix.proxy-pgsql
- zabbix.proxy-sqlite
- zabbix.server-mysql
- zabbix.server-pgsql
- zabbix60.proxy-mysql
- zabbix60.proxy-pgsql
- zabbix70.proxy-mysql
- zabbix70.proxy-pgsql
- zabbix72.proxy-mysql
- zabbix72.proxy-pgsql
- zabbix74.proxy-mysql
- zabbix74.proxy-pgsql
- zabbix60.proxy-sqlite
- zabbix60.server-mysql
- zabbix60.server-pgsql
- zabbix70.proxy-sqlite
- zabbix70.server-mysql
- zabbix70.server-pgsql
- zabbix72.proxy-sqlite
- zabbix72.server-mysql
- zabbix72.server-pgsql
- zabbix74.proxy-sqlite
- zabbix74.server-mysql
- zabbix74.server-pgsql
- python312Packages.pyzabbix
- python313Packages.pyzabbix
- python314Packages.pyzabbix
- python312Packages.py-zabbix
- python313Packages.py-zabbix
- python314Packages.py-zabbix
- python312Packages.zabbix-utils
- python313Packages.zabbix-utils
- python314Packages.zabbix-utils
- zabbix-agent2-plugin-postgresql
4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

Stored XSS vulnerability in the Item history/Plain text widget

https://support.zabbix.com/browse/ZBX-27760

Zabbix

=<7.4.7
=<7.0.23
=<6.0.44

NIXPKGS-2026-1421

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-29090

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database

https://github.com/rucio/rucio/security/advisories/GHSA-6j7p-qjhg-9947 x_refsource_CONFIRM

rucio

==>= 40.0.0, < 40.1.1
==>= 1.30.0, < 35.8.5
==>= 35.9.0, < 38.5.5
==>= 38.6.0, < 39.4.2

NIXPKGS-2026-1420

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-23927

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
53 packages
- zabbixctl
- zabbix-cli
- zabbix.web
- zabbix.agent
- zabbix60.web
- zabbix70.web
- zabbix72.web
- zabbix74.web
- zabbix.agent2
- zabbix.server
- zabbix60.agent
- zabbix70.agent
- zabbix72.agent
- zabbix74.agent
- zabbix60.server
- zabbix70.server
- zabbix72.server
- zabbix74.server
- zabbix.proxy-mysql
- zabbix.proxy-pgsql
- zabbix.proxy-sqlite
- zabbix.server-mysql
- zabbix.server-pgsql
- zabbix60.proxy-mysql
- zabbix60.proxy-pgsql
- zabbix70.proxy-mysql
- zabbix70.proxy-pgsql
- zabbix72.proxy-mysql
- zabbix72.proxy-pgsql
- zabbix74.proxy-mysql
- zabbix74.proxy-pgsql
- zabbix60.proxy-sqlite
- zabbix60.server-mysql
- zabbix60.server-pgsql
- zabbix70.proxy-sqlite
- zabbix70.server-mysql
- zabbix70.server-pgsql
- zabbix72.proxy-sqlite
- zabbix72.server-mysql
- zabbix72.server-pgsql
- zabbix74.proxy-sqlite
- zabbix74.server-mysql
- zabbix74.server-pgsql
- python312Packages.pyzabbix
- python313Packages.pyzabbix
- python314Packages.pyzabbix
- python312Packages.py-zabbix
- python313Packages.py-zabbix
- python314Packages.py-zabbix
- python312Packages.zabbix-utils
- python313Packages.zabbix-utils
- python314Packages.zabbix-utils
- zabbix-agent2-plugin-postgresql
4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter

https://support.zabbix.com/browse/ZBX-27759

Zabbix

=<7.4.7
=<7.0.23
=<6.0.44

NIXPKGS-2026-1418

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-35579

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports

https://github.com/coredns/coredns/security/advisories/GHSA-vp29-5652-4fw9 x_refsource_CONFIRM

coredns

==< 1.14.3

NIXPKGS-2026-1419

GitHub issue published 4 months, 1 week ago

          Permalink
          
            CVE-2026-39849
          
              updated
            
          4 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
                5 packages
                swiftlint
python312Packages.softlayer
python313Packages.softlayer
python314Packages.softlayer
chickenPackages_5.chickenEggs.ftl

          4 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
              reference https://g…
            
          4 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          4 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months, 1 week ago
          
            Pi-hole FTL remote code execution via newline injection in dns.interface configuration
          
      https://github.com/pi-hole/FTL/security/advisories/GHSA-9cqv-839p-gpq2
    
    x_refsource_CONFIRM
  
      https://github.com/pi-hole/FTL/commit/0c46e4ec7fe57f762fce261625f2cf5d43806e6d
    
    x_refsource_MISC
  
          Ignored references (1)
        
      https://github.com/pi-hole/FTL/releases/tag/v6.6.1
    
    x_refsource_MISC
  
    FTL

            ==< 6.6.1

NIXPKGS-2026-1417

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-33190

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored reference https://g… 4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

CoreDNS TSIG authentication bypass on encrypted DNS transports

https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh x_refsource_CONFIRM

Ignored references (1)

https://github.com/coredns/coredns/releases/tag/v1.14.3 x_refsource_MISC

coredns

==< 1.14.3

NIXPKGS-2026-1416

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-39852

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

Quarkus authorization bypass via semicolon path normalization inconsistency

https://github.com/quarkusio/quarkus/security/advisories/GHSA-rc95-pcm8-65v9 x_refsource_CONFIRM

quarkus

==>= 3.34.0, < 3.34.7
==>= 3.27.3.0, < 3.27.3.1
==>= 3.35.0, < 3.35.2
==< 3.20.6.1

NIXPKGS-2026-1413

GitHub issue published 4 months, 1 week ago

          Permalink
          
            CVE-2026-27644
          
        6.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          4 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
                7 packages
                python312Packages.pytraccar
python313Packages.pytraccar
python314Packages.pytraccar
home-assistant-component-tests.traccar
tests.home-assistant-components.traccar
home-assistant-component-tests.traccar_server
tests.home-assistant-components.traccar_server

          4 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
              reference https://g…
            
          4 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          4 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months, 1 week ago
          
            traccar allows CSV formula injection via exported position data
          
      https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7
    
    x_refsource_CONFIRMexploit
  
          Ignored references (1)
        
      https://github.com/traccar/traccar/blob/v6.11.1/src/main/java/org/traccar/reports/CsvExportProvider.java#L89-L91
    
    x_refsource_MISC
  
    traccar

            ==>= 6.11.1 , < 6.13.0

Nixpkgs security tracker

Published issues

Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation

Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker

Stored XSS vulnerability in the Item history/Plain text widget

Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database

Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter

CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports

Pi-hole FTL remote code execution via newline injection in dns.interface configuration

CoreDNS TSIG authentication bypass on encrypted DNS transports

Quarkus authorization bypass via semicolon path normalization inconsistency

traccar allows CSV formula injection via exported position data