NIXPKGS-2026-0560

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-28223

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt ignored
  11 packages

  • python313Packages.wagtail
  • python314Packages.wagtail
  • python312Packages.wagtail-localize
  • python313Packages.wagtail-localize
  • python314Packages.wagtail-localize
  • python312Packages.wagtail-factories
  • python313Packages.wagtail-factories
  • python314Packages.wagtail-factories
  • python312Packages.wagtail-modeladmin
  • python313Packages.wagtail-modeladmin
  • python314Packages.wagtail-modeladmin
  3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface

• https://github.com/wagtail/wagtail/security/advisories/GHSA-p4v8-rw59-93cq x_refsource_CONFIRM
• https://github.com/wagtail/wagtail/commit/1c6f2effed68f4ccad6fbd07987e03641505f863 x_refsource_MISC
• https://github.com/wagtail/wagtail/commit/ba70244d376a7b1bd180ded03e827917ff410c19 x_refsource_MISC
• https://github.com/wagtail/wagtail/commit/d8c5900982df8ed5938ad993aa9ff69cda50f80c x_refsource_MISC
• https://github.com/wagtail/wagtail/commit/ee39d39deeb7f250fe886417b24802d7e05b1143 x_refsource_MISC
• https://github.com/wagtail/wagtail/releases/tag/v6.3.8 x_refsource_MISC
• https://github.com/wagtail/wagtail/releases/tag/v7.0.6 x_refsource_MISC
• https://github.com/wagtail/wagtail/releases/tag/v7.2.3 x_refsource_MISC
• https://github.com/wagtail/wagtail/releases/tag/v7.3.1 x_refsource_MISC

---

wagtail

• ==>= 7.3rc1, < 7.3.1
• ==>= 6.4rc1, < 7.0.6
• ==>= 7.1rc1, < 7.2.3
• ==< 6.3.8

Please update to 7.2.3.

NIXPKGS-2026-0537

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-28804

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt ignored
  10 packages

  • capypdf
  • python312Packages.pypdf2
  • python312Packages.pypdf3
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python312Packages.pypdfium2
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

pypdf: Inefficient decoding of ASCIIHexDecode streams

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852 x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3666 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.7.5 x_refsource_MISC

---

pypdf

• ==< 6.7.5

NIXPKGS-2026-0532

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-30225

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

OliveTin: RestartAction always runs actions as guest

• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-p443-p7w5-2f7f x_refsource_CONFIRM
• https://github.com/OliveTin/OliveTin/commit/cb46a597b2465235839ed58cf034b5e7b70ef911 x_refsource_MISC
• https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1 x_refsource_MISC

---

OliveTin

• ==< 3000.11.1

NIXPKGS-2026-0527

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-29790

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

dbt-common: commonprefix() doesn't protect against path traversal

• https://github.com/dbt-labs/dbt-common/security/advisories/GHSA-w75w-9qv4-j5xj x_refsource_CONFIRM
• https://github.com/pypa/pip/pull/13777 x_refsource_MISC
• https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709 x_refsource_MISC

---

dbt-common

• ==< 1.37.3
• ==< 1.34.2

NIXPKGS-2026-0529

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-30223

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes

• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-g962-2j28-3cg9 x_refsource_CONFIRM
• https://github.com/OliveTin/OliveTin/commit/e97d8ecbd8d6ba468c418ca496fcd18f78131233 x_refsource_MISC
• https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1 x_refsource_MISC

---

OliveTin

• ==< 3000.11.1

NIXPKGS-2026-0534

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-28683

8.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

Gokapi: Stored XSS in SVG Hotlinks

• https://github.com/Forceu/Gokapi/security/advisories/GHSA-3c22-5j5m-4jq7 x_refsource_CONFIRM
• https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC

---

Gokapi

• ==< 2.2.3

NIXPKGS-2026-0539

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-28785

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

Ghostfolio: Time-Based Blind SQL Injection in Manual Asset Import

• https://github.com/ghostfolio/ghostfolio/security/advisories/GHSA-m5cc-7jw5-34xp x_refsource_CONFIRM
• https://github.com/ghostfolio/ghostfolio/releases/tag/2.244.0 x_refsource_MISC

---

ghostfolio

• ==< 2.244.0

NixOS Unstable fixed in https://github.com/NixOS/nixpkgs/pull/496350

NIXPKGS-2026-0541

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-29059

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly

• https://github.com/windmill-labs/windmill/security/advisories/GHSA-24fr-44f8-fqwg x_refsource_CONFIRM
• https://github.com/windmill-labs/windmill/releases/tag/v1.603.3 x_refsource_MISC

---

windmill

• ==< 1.603.3

NIXPKGS-2026-0563

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-27982

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

An open redirect vulnerability exists in django-allauth versions prior to …

• https://allauth.org/news/2026/02/django-allauth-65.14.1-released/
• https://jvn.jp/en/jp/JVN23669411/

---

django-allauth

• ==prior to 65.14.1

https://allauth.org/news/2026/02/django-allauth-65.14.1-released/

NIXPKGS-2026-0558

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2025-40931

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id

• https://metacpan.org/dist/Apache-Session/source/lib/Apache/Session/Generate/MD5…
• https://security.metacpan.org/docs/guides/random-data-for-security.html technical-description
• http://www.openwall.com/lists/oss-security/2026/03/05/3

---

Apache-Session

• =<1.94