NIXPKGS-2026-1088

GitHub issue published 5 months ago

Permalink CVE-2025-66236

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI

• https://github.com/apache/airflow/pull/58662 patch
• https://lists.apache.org/thread/g8fyy1tkmxkkfk7tx2v6h8mvwzpyykbo vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/04/13/6

---

apache-airflow

• <3.2.0

NIXPKGS-2026-1089

GitHub issue published 5 months ago

Permalink CVE-2026-5054

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

NoMachine External Control of File Path Local Privilege Escalation Vulnerability

• ZDI-26-248 x_research-advisory

---

NoMachine

• ==9.3.7

https://kb.nomachine.com/SU03X00271

NIXPKGS-2026-1087

GitHub issue published 5 months ago

Permalink CVE-2026-4152

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  18 packages

  • zigimports
  • gimpPlugins.gimp
  • gimpPlugins.gmic
  • gimp-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp3-with-plugins
  • gimp2Plugins.fourier
  • gimp2Plugins.farbfeld
  • gimpPlugins.lightning
  • gimp2Plugins.lightning
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.texturize
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

• ZDI-26-219 x_research-advisory
• vendor-provided URL vendor-advisory

---

GIMP

• ==3.0.8

NIXPKGS-2026-1086

GitHub issue published 5 months ago

Permalink CVE-2026-33948

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  38 packages

  • ijq
  • jql
  • jqp
  • njq
  • gojq
  • jqfmt
  • jq-lsp
  • jquake
  • jq-zsh-plugin
  • python312Packages.jq
  • python313Packages.jq
  • python314Packages.jq
  • python312Packages.llm-jq
  • python313Packages.llm-jq
  • python314Packages.llm-jq
  • haskellPackages.js-jquery
  • tests.fetchpatch.relative
  • python312Packages.xstatic-jquery
  • python313Packages.xstatic-jquery
  • python314Packages.xstatic-jquery
  • python312Packages.django-jquery-js
  • python313Packages.django-jquery-js
  • python314Packages.django-jquery-js
  • python312Packages.xstatic-jquery-ui
  • python313Packages.xstatic-jquery-ui
  • python314Packages.xstatic-jquery-ui
  • tree-sitter-grammars.tree-sitter-jq
  • tests.fetchNextcloudApp.simple-sha512
  • vimPlugins.nvim-treesitter-parsers.jq
  • python312Packages.sphinxcontrib-jquery
  • python313Packages.sphinxcontrib-jquery
  • python314Packages.sphinxcontrib-jquery
  • tests.fetchFromGitHub.submodule-leave-git
  • python312Packages.xstatic-jquery-file-upload
  • python313Packages.xstatic-jquery-file-upload
  • python314Packages.xstatic-jquery-file-upload
  • python313Packages.tree-sitter-grammars.tree-sitter-jq
  • python314Packages.tree-sitter-grammars.tree-sitter-jq
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input

• https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9 x_refsource_CONFIRM
• https://github.com/jqlang/jq/commit/6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b x_refsource_MISC

---

jq

• ==< 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b

NIXPKGS-2026-1085

GitHub issue published 5 months ago

Permalink CVE-2026-33947

6.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  38 packages

  • ijq
  • jql
  • jqp
  • njq
  • gojq
  • jqfmt
  • jq-lsp
  • jquake
  • jq-zsh-plugin
  • python312Packages.jq
  • python313Packages.jq
  • python314Packages.jq
  • python312Packages.llm-jq
  • python313Packages.llm-jq
  • python314Packages.llm-jq
  • haskellPackages.js-jquery
  • tests.fetchpatch.relative
  • python312Packages.xstatic-jquery
  • python313Packages.xstatic-jquery
  • python314Packages.xstatic-jquery
  • python312Packages.django-jquery-js
  • python313Packages.django-jquery-js
  • python314Packages.django-jquery-js
  • python312Packages.xstatic-jquery-ui
  • python313Packages.xstatic-jquery-ui
  • python314Packages.xstatic-jquery-ui
  • tree-sitter-grammars.tree-sitter-jq
  • tests.fetchNextcloudApp.simple-sha512
  • vimPlugins.nvim-treesitter-parsers.jq
  • python312Packages.sphinxcontrib-jquery
  • python313Packages.sphinxcontrib-jquery
  • python314Packages.sphinxcontrib-jquery
  • tests.fetchFromGitHub.submodule-leave-git
  • python312Packages.xstatic-jquery-file-upload
  • python313Packages.xstatic-jquery-file-upload
  • python314Packages.xstatic-jquery-file-upload
  • python313Packages.tree-sitter-grammars.tree-sitter-jq
  • python314Packages.tree-sitter-grammars.tree-sitter-jq
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()

• https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg x_refsource_CONFIRM
• https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f x_refsource_MISC

---

jq

• ==< fb59f1491058d58bdc3e8dd28f1773d1ac690a1f

NIXPKGS-2026-1084

GitHub issue published 5 months ago

Permalink CVE-2026-39979

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  38 packages

  • ijq
  • jql
  • jqp
  • njq
  • gojq
  • jqfmt
  • jq-lsp
  • jquake
  • jq-zsh-plugin
  • python312Packages.jq
  • python313Packages.jq
  • python314Packages.jq
  • python312Packages.llm-jq
  • python313Packages.llm-jq
  • python314Packages.llm-jq
  • haskellPackages.js-jquery
  • tests.fetchpatch.relative
  • python312Packages.xstatic-jquery
  • python313Packages.xstatic-jquery
  • python314Packages.xstatic-jquery
  • python312Packages.django-jquery-js
  • python313Packages.django-jquery-js
  • python314Packages.django-jquery-js
  • python312Packages.xstatic-jquery-ui
  • python313Packages.xstatic-jquery-ui
  • python314Packages.xstatic-jquery-ui
  • tree-sitter-grammars.tree-sitter-jq
  • tests.fetchNextcloudApp.simple-sha512
  • vimPlugins.nvim-treesitter-parsers.jq
  • python312Packages.sphinxcontrib-jquery
  • python313Packages.sphinxcontrib-jquery
  • python314Packages.sphinxcontrib-jquery
  • tests.fetchFromGitHub.submodule-leave-git
  • python312Packages.xstatic-jquery-file-upload
  • python313Packages.xstatic-jquery-file-upload
  • python314Packages.xstatic-jquery-file-upload
  • python313Packages.tree-sitter-grammars.tree-sitter-jq
  • python314Packages.tree-sitter-grammars.tree-sitter-jq
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

• https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p x_refsource_CONFIRM
• https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f x_refsource_MISC

---

jq

• ==< 2f09060afab23fe9390cce7cb860b10416e1bf5f

NIXPKGS-2026-1083

GitHub issue published 5 months ago

Permalink CVE-2026-5053

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

NoMachine External Control of File Path Arbitrary File Deletion Vulnerability

• ZDI-26-247 x_research-advisory

---

NoMachine

• ==9.3.7

https://kb.nomachine.com/SU03X00271

NIXPKGS-2026-1082

GitHub issue published 5 months ago

Permalink CVE-2026-4150

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  18 packages

  • zigimports
  • gimpPlugins.gimp
  • gimpPlugins.gmic
  • gimp-with-plugins
  • gimp2Plugins.bimp
  • gimp2Plugins.gimp
  • gimp2Plugins.gmic
  • gimp2-with-plugins
  • gimp3-with-plugins
  • gimp2Plugins.fourier
  • gimp2Plugins.farbfeld
  • gimpPlugins.lightning
  • gimp2Plugins.lightning
  • gimp2Plugins.lqrPlugin
  • gimp2Plugins.texturize
  • gimp2Plugins.gimplensfun
  • gimpPlugins.resynthesizer
  • gimp2Plugins.waveletSharpen
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability

• ZDI-26-217 x_research-advisory
• vendor-provided URL vendor-advisory

---

GIMP

• ==3.0.8

NIXPKGS-2026-1081

GitHub issue published 5 months ago

Permalink CVE-2026-5055

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

• ZDI-26-249 x_research-advisory

---

NoMachine

• ==9.2.18_1

https://kb.nomachine.com/SU03X00271

NIXPKGS-2026-1080

GitHub issue published 5 months ago

Permalink CVE-2026-2728

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site …

• https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#xss-on-showcon… exploit

---

librenms

• <26.3.0