NIXPKGS-2026-1144

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40505

3.3 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  10 packages

  • python312Packages.pymupdf
  • python313Packages.pymupdf
  • python314Packages.pymupdf
  • python312Packages.pymupdf4llm
  • python313Packages.pymupdf4llm
  • python314Packages.pymupdf4llm
  • zathuraPkgs.zathura_pdf_mupdf
  • python312Packages.pymupdf-fonts
  • python313Packages.pymupdf-fonts
  • python314Packages.pymupdf-fonts
  4 months, 4 weeks ago
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

MuPDF mutool ANSI Injection via Metadata

• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c… patch
• https://www.vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadata third-party-advisory

---

MuPDF

• <0f17d789fe8c29b41e47663be82514aaca3a4dfb

NIXPKGS-2026-1143

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-31987

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

Apache Airflow: JWT token appearing in logs

• https://github.com/apache/airflow/pull/62964 patch
• https://github.com/apache/airflow/issues/62428 issue-tracking
• https://github.com/apache/airflow/issues/62773 issue-tracking
• https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/04/16/7

---

apache-airflow

• <3.2.0

NIXPKGS-2026-1142

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40259

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7m5h-w69j-qggg x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 x_refsource_MISC

---

siyuan

• ==< 0.0.0-20260407035653-2f416e5253f1
• ==< 3.6.4

NIXPKGS-2026-1141

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40922

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8q5w-mmxf-48jg x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/commit/b382f50e1880ed996364509de5a10a72d7409428 x_refsource_MISC

Ignored references (2)

• https://github.com/advisories/GHSA-4663-4mpg-879v x_refsource_MISC
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 x_refsource_MISC

---

siyuan

• ==< 3.6.4

NIXPKGS-2026-1140

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40959

9.3 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  2 packages

  • luanti-client
  • luanti-server
  4 months, 4 weeks ago
• @LeSuisse ignored
  3 maintainers

  • @06kellyjac
  • @fpletz
  • @fgaz
  4 months, 4 weeks ago maintainer.ignore
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

Luanti 5 before 5.15.2, when LuaJIT is used, allows a …

• https://github.com/luanti-org/luanti/security/advisories/GHSA-g596-mf82-w8c3
• https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557…
• https://github.com/luanti-org/luanti/commit/53cef183e2a85a4daff84ac1a9a7946f940…

---

Luanti

• <5.15.2

NIXPKGS-2026-1139

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-33472

4.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored package cryptomator-cli 4 months, 4 weeks ago
• @LeSuisse ignored
  2 maintainers

  • @gepbird
  • @bachp
  4 months, 4 weeks ago maintainer.ignore
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)

• https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9q8x-whrw-x44p x_refsource_CONFIRM
• https://github.com/cryptomator/cryptomator/pull/4179 x_refsource_MISC
• https://github.com/cryptomator/cryptomator/releases/tag/1.19.2 x_refsource_MISC

---

cryptomator

• ==>= 1.19.1, < 1.19.2

NIXPKGS-2026-1138

GitHub issue published 4 months, 4 weeks ago

Permalink CVE-2026-40960

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 4 months, 4 weeks ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  2 packages

  • luanti-client
  • luanti-server
  4 months, 4 weeks ago
• @LeSuisse ignored
  3 maintainers

  • @fpletz
  • @fgaz
  • @06kellyjac
  4 months, 4 weeks ago maintainer.ignore
• @LeSuisse accepted 4 months, 4 weeks ago
• @LeSuisse published on GitHub 4 months, 4 weeks ago

Luanti 5 before 5.15.2 sometimes allows unintended access to an …

• https://github.com/luanti-org/luanti/security/advisories/GHSA-22c4-238c-m5j4
• https://github.com/luanti-org/luanti/commit/0faf529bc4b89e70a275ed1162047815118…
• https://github.com/luanti-org/luanti/commit/827fd4cf7f989482b2dad381fa4afd642ea…

---

Luanti

• <5.15.2

NIXPKGS-2026-1137

GitHub issue published 5 months ago

Permalink CVE-2026-33214

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  8 packages

  • python313Packages.weblate-fonts
  • python314Packages.weblate-fonts
  • python312Packages.weblate-schemas
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python312Packages.weblate-language-data
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Weblate has improper access control for the translation memory API

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-mpf5-3vph-q75r x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/pull/18513 x_refsource_MISC

---

weblate

• ==< 5.17

NIXPKGS-2026-1136

GitHub issue published 5 months ago

Permalink CVE-2026-33220

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  8 packages

  • python313Packages.weblate-fonts
  • python314Packages.weblate-fonts
  • python312Packages.weblate-schemas
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python312Packages.weblate-language-data
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-mqph-7h49-hqfm x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/pull/18516 x_refsource_MISC

---

weblate

• ==< 5.17

NIXPKGS-2026-1135

GitHub issue published 5 months ago

Permalink CVE-2026-40256

5.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  8 packages

  • python313Packages.weblate-fonts
  • python314Packages.weblate-fonts
  • python312Packages.weblate-schemas
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python312Packages.weblate-language-data
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-ffgh-3jrf-8wvh x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/commit/e30dbcb33ae78e754ecef192d54f996b89cb4e15 x_refsource_MISC

---

weblate

• ==< 5.17