NIXPKGS-2026-0533

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-29178

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt ignored
  2 packages

  • lemmy-ui
  • lemmy-help
  3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint

• https://github.com/LemmyNet/lemmy/security/advisories/GHSA-jvxv-2jjp-jxc3 x_refsource_CONFIRMexploit
• https://github.com/LemmyNet/lemmy/commit/f47a03f56d1797bceab5f34b6f624c91cecd5871 x_refsource_MISC

---

lemmy

• ==< 0.19.16

NIXPKGS-2026-0556

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-28789

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling

• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-45m3-398w-m2m9 x_refsource_CONFIRM
• https://github.com/OliveTin/OliveTin/commit/f044d90d5525c4c8e3f421b32ed7eff771c22d36 x_refsource_MISC

---

OliveTin

• ==< 3000.10.3

NIXPKGS-2026-0551

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-29061

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion

• https://github.com/Forceu/Gokapi/security/advisories/GHSA-q658-hfpg-35qc x_refsource_CONFIRM
• https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC

---

Gokapi

• ==< 2.2.3

NIXPKGS-2026-0531

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-28682

6.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

Gokapi: Data Leak in Upload Status Stream

• https://github.com/Forceu/Gokapi/security/advisories/GHSA-c36c-7pc2-f2ph x_refsource_CONFIRM
• https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC

---

Gokapi

• ==< 2.2.3

NIXPKGS-2026-0536

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-29084

4.6 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

Gokapi: CSRF in Login Endpoint

• https://github.com/Forceu/Gokapi/security/advisories/GHSA-hcff-qv74-7hr4 x_refsource_CONFIRM
• https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC

---

Gokapi

• ==< 2.2.3

NIXPKGS-2026-0562

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-29188

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt ignored
  4 packages

  • python314Packages.filebrowser-safe
  • python313Packages.filebrowser-safe
  • python312Packages.filebrowser-safe
  • filebrowser-quantum
  3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

File Browser: TUS Delete Endpoint Bypasses Delete Permission Check

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-79pf-vx4x-7jmm x_refsource_CONFIRM
• https://github.com/filebrowser/filebrowser/commit/7ed1425115be602c2b23236c410098ea2d74b42f x_refsource_MISC
• https://github.com/filebrowser/filebrowser/releases/tag/v2.61.1 x_refsource_MISC

---

filebrowser

• ==< 2.61.1

NIXPKGS-2026-0557

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-28342

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint

• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp x_refsource_CONFIRM
• https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90 x_refsource_MISC
• https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2 x_refsource_MISC

---

OliveTin

• ==< 3000.10.2

NIXPKGS-2026-0530

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-26017

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

CoreDNS ACL Bypass

• https://github.com/coredns/coredns/security/advisories/GHSA-c9v3-4pv7-87pr x_refsource_CONFIRM
• https://github.com/coredns/coredns/releases/tag/v1.14.2 x_refsource_MISC

---

coredns

• ==< 1.14.2

NIXPKGS-2026-0552

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-29064

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

Zarf: Symlink targets in archives are not validated against destination directory

• https://github.com/zarf-dev/zarf/security/advisories/GHSA-hcm4-6hpj-vghm x_refsource_CONFIRM
• https://github.com/zarf-dev/zarf/releases/tag/v0.73.1 x_refsource_MISC

---

zarf

• ==>= 0.54.0, < 0.73.1

https://github.com/zarf-dev/zarf/security/advisories/GHSA-hcm4-6hpj-vghm

NIXPKGS-2026-0535

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-29074

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months, 2 weeks ago by @mweinelt Activity log

• Created suggestion 3 months, 2 weeks ago
• @mweinelt ignored
  2 packages

  • nodePackages.svgo
  • nodePackages_latest.svgo
  3 months, 2 weeks ago
• @mweinelt accepted 3 months, 2 weeks ago
• @mweinelt published on GitHub 3 months, 2 weeks ago

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

• https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673 x_refsource_CONFIRM

---

svgo

• === 4.0.0
• ==>= 3.0.0, < 3.3.3
• ==>= 2.1.0, < 2.8.1