NIXPKGS-2026-1384

GitHub issue published 4 months, 1 week ago

          Permalink
          
            CVE-2026-42146
          
        5.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          4 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
              reference https://g…
            
          4 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          4 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months, 1 week ago
          
            CImg Library: Uncontrolled memory allocation via nb_colors field in _load_bmp
          
      https://github.com/GreycLab/CImg/security/advisories/GHSA-g54r-qmgx-c6fv
    
    x_refsource_CONFIRM
  
      https://github.com/GreycLab/CImg/issues/477
    
    x_refsource_MISC
  
      https://github.com/GreycLab/CImg/commit/c3aacf5b96ac1e54b7af1957c6737dbf3949f6d3
    
    x_refsource_MISC
  
          Ignored references (1)
        
      https://github.com/GreycLab/CImg/releases/tag/v.3.7.5
    
    x_refsource_MISC
  
    CImg

            ==< c3aacf5b96ac1e54b7af1957c6737dbf3949f6d3

NIXPKGS-2026-1383

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-42052

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
9 packages
- python312Packages.beets-audible
- python312Packages.beets-minimal
- python313Packages.beets-audible
- python313Packages.beets-minimal
- python314Packages.beets-audible
- python312Packages.beets-alternatives
- python314Packages.beets-alternatives
- python313Packages.beets-alternatives
- pkgsRocm.python3Packages.beets-audible
4 months, 1 week ago
@LeSuisse restored
2 packages
- python312Packages.beets-minimal
- python313Packages.beets-minimal
4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

beets is Vulnerable to XSS

https://github.com/beetbox/beets/security/advisories/GHSA-3gxm-wfjx-m847 x_refsource_CONFIRM
https://github.com/beetbox/beets/releases/tag/v2.10.0 x_refsource_MISC

beets

==< 2.10.0

NIXPKGS-2026-1382

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-43863

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
12 packages
- mutter
- neomutt
- mutt-ics
- mutter46
- mutter48
- mutt-wizard
- fontmuttmisc
- notmuch-mutt
- font-mutt-misc
- pantheon.mutter
- xorg.fontmuttmisc
- vimPlugins.nvim-treesitter-parsers.muttrc
4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

mutt before 2.3.2 has an infinite loop in data_object_to_stream in …

https://github.com/muttmua/mutt/commit/fdc04a171777327218a1e78db504926c388b48c4

mutt

<2.3.2

NIXPKGS-2026-1381

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-43864

2.5 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
12 packages
- mutter
- neomutt
- mutt-ics
- mutter46
- mutter48
- mutt-wizard
- fontmuttmisc
- notmuch-mutt
- font-mutt-misc
- pantheon.mutter
- xorg.fontmuttmisc
- vimPlugins.nvim-treesitter-parsers.muttrc
4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.

https://github.com/muttmua/mutt/commit/ebfa2969042d89303d15334193fcc32866c8a8df

mutt

<2.3.2

NIXPKGS-2026-1380

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-43861

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
12 packages
- mutter
- neomutt
- mutt-ics
- mutter46
- mutter48
- mutt-wizard
- fontmuttmisc
- notmuch-mutt
- font-mutt-misc
- pantheon.mutter
- xorg.fontmuttmisc
- vimPlugins.nvim-treesitter-parsers.muttrc
4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

mutt before 2.3.2 does not check for '\0' in url_pct_decode.

https://github.com/muttmua/mutt/commit/12f54fe3b61f761c096fe95e95d5e3072af00ed2

mutt

<2.3.2

NIXPKGS-2026-1379

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-43859

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
12 packages
- mutter
- neomutt
- mutt-ics
- mutter46
- mutter48
- mutt-wizard
- fontmuttmisc
- notmuch-mutt
- font-mutt-misc
- pantheon.mutter
- xorg.fontmuttmisc
- vimPlugins.nvim-treesitter-parsers.muttrc
4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for …

https://github.com/muttmua/mutt/commit/834c5a2ed0479e51e8662a31caed129f136f4805

mutt

<2.3.2

NIXPKGS-2026-1378

GitHub issue published 4 months, 1 week ago

          Permalink
          
            CVE-2026-33846
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          4 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                guile-gnutls
python312Packages.python3-gnutls
python313Packages.python3-gnutls
python314Packages.python3-gnutls

          4 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
              maintainer @vcunat
            
          4 months, 1 week ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          4 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months, 1 week ago
          
            Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly
          
      RHSA-2026:13274
    
    x_refsource_REDHATvendor-advisory
  
      https://access.redhat.com/security/cve/CVE-2026-33846
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2450625
    
    x_refsource_REDHATissue-tracking
  
    rhcos

    gnutls

    gnutls-main

            *

NIXPKGS-2026-1377

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-43862

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
12 packages
- mutter
- neomutt
- mutt-ics
- mutter46
- mutter48
- mutt-wizard
- fontmuttmisc
- notmuch-mutt
- font-mutt-misc
- pantheon.mutter
- xorg.fontmuttmisc
- vimPlugins.nvim-treesitter-parsers.muttrc
4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

In mutt before 2.3.2, the imap_auth_gss security level is mishandled.

https://github.com/muttmua/mutt/commit/f547a849cdacb512800a5f477c27de217e1c8151

mutt

<2.3.2

https://www.openwall.com/lists/oss-security/2026/05/04/3

NIXPKGS-2026-1376

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-43860

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
12 packages
- mutter
- neomutt
- mutt-ics
- mutter46
- mutter48
- mutt-wizard
- fontmuttmisc
- notmuch-mutt
- font-mutt-misc
- pantheon.mutter
- xorg.fontmuttmisc
- vimPlugins.nvim-treesitter-parsers.muttrc
4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

mutt before 2.3.2 sometimes truncates the hash_passwd by one byte …

https://github.com/muttmua/mutt/commit/834c5a2ed0479e51e8662a31caed129f136f4805

mutt

<2.3.2

https://www.openwall.com/lists/oss-security/2026/05/04/3

NIXPKGS-2026-1375

GitHub issue published 4 months, 1 week ago

Permalink CVE-2026-40068

updated 4 months, 1 week ago by @LeSuisse Activity log

Created suggestion 4 months, 1 week ago
@LeSuisse ignored
6 packages
- claude-code-acp
- claude-code-router
- gnomeExtensions.claude-code-usage
- gnomeExtensions.claude-code-switcher
- vscode-extensions.anthropic.claude-code
- gnomeExtensions.claude-code-usage-indicator
4 months, 1 week ago
@LeSuisse accepted 4 months, 1 week ago
@LeSuisse published on GitHub 4 months, 1 week ago

Claude Code arbitrary code execution via git worktree commondir trust dialog bypass

https://github.com/anthropics/claude-code/security/advisories/GHSA-q5hj-mxqh-vv77 x_refsource_CONFIRM

claude-code

==>= 2.1.63, < 2.1.84

Nixpkgs security tracker

Published issues

CImg Library: Uncontrolled memory allocation via nb_colors field in _load_bmp

beets is Vulnerable to XSS

mutt before 2.3.2 has an infinite loop in data_object_to_stream in …

mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.

mutt before 2.3.2 does not check for '\0' in url_pct_decode.

mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for …

Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly

In mutt before 2.3.2, the imap_auth_gss security level is mishandled.

mutt before 2.3.2 sometimes truncates the hash_passwd by one byte …

Claude Code arbitrary code execution via git worktree commondir trust dialog bypass