NIXPKGS-2026-1059

GitHub issue published 5 months ago

Permalink CVE-2026-6068

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  5 packages

  • nasmfmt
  • vimPlugins.nvim-treesitter-parsers.nasm
  • python313Packages.tree-sitter-grammars.tree-sitter-nasm
  • python314Packages.tree-sitter-grammars.tree-sitter-nasm
  • tree-sitter-grammars.tree-sitter-nasm
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

CVE-2026-6068

• https://github.com/netwide-assembler/nasm/issues/222

---

NASM

• ==nasm-3.02rc5

No patch available at the CVE publication

NIXPKGS-2026-1058

GitHub issue published 5 months ago

Permalink CVE-2026-35598

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Vikunja has Missing Authorization on CalDAV Task Read

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x x_refsource_CONFIRM
• https://github.com/go-vikunja/vikunja/pull/2579 x_refsource_MISC
• https://github.com/go-vikunja/vikunja/commit/879462d717351fe5d276ddec5246bdec31b41661 x_refsource_MISC

Ignored references (1)

• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC

---

vikunja

• ==< 2.3.0

NIXPKGS-2026-1057

GitHub issue published 5 months ago

Permalink CVE-2026-35600

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored package vikunja-desktop 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-45q4-x4r9-8fqj x_refsource_CONFIRM
• https://github.com/go-vikunja/vikunja/pull/2580 x_refsource_MISC
• https://github.com/go-vikunja/vikunja/commit/0f3730d045f20e261e3cdfc6d93c325653395b64 x_refsource_MISC

Ignored references (1)

• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC

---

vikunja

• ==< 2.3.0

NIXPKGS-2026-1056

GitHub issue published 5 months ago

Permalink CVE-2026-40217

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code …

• https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/

---

LiteLLM

• ==bb0639701796218a3447160e55c0f1097446e4e6085df7dfd39f476d4143743f

NIXPKGS-2026-1055

GitHub issue published 5 months ago

Permalink CVE-2026-34727

7.4 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored package vikunja-desktop 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8jvc-mcx6-r4cg x_refsource_CONFIRM

---

vikunja

• ==< 2.3.0

NIXPKGS-2026-1054

GitHub issue published 5 months ago

Permalink CVE-2026-35595

8.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored package vikunja-desktop 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Vikunja Affected by Privilege Escalation via Project Reparenting

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2vq4-854f-5c72 x_refsource_CONFIRM
• https://github.com/go-vikunja/vikunja/pull/2583 x_refsource_MISC
• https://github.com/go-vikunja/vikunja/commit/c03d682f48aff890eeb3c8b41d38226069722827 x_refsource_MISC

Ignored references (1)

• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC

---

vikunja

• ==< 2.3.0

NIXPKGS-2026-1053

GitHub issue published 5 months ago

Permalink CVE-2026-27460

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Tandoor Recipes Affected by Denial of Service via Recipe Import

• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-w8pq-4pwf-r2m8 x_refsource_CONFIRM

---

recipes

• ==< 2.6.5

NIXPKGS-2026-1052

GitHub issue published 5 months ago

Permalink CVE-2026-35597

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored package vikunja-desktop 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fgfv-pv97-6cmj x_refsource_CONFIRM
• https://github.com/go-vikunja/vikunja/pull/2576 x_refsource_MISC
• https://github.com/go-vikunja/vikunja/commit/6ca0151d02fa0e8c7e2181ab916a28e08caaaec8 x_refsource_MISC

Ignored references (1)

• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC

---

vikunja

• ==< 2.3.0

NIXPKGS-2026-1051

GitHub issue published 5 months ago

Permalink CVE-2026-40086

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Rembg has a Path Traversal via Custom Model Loading

• https://github.com/danielgatis/rembg/security/advisories/GHSA-3wqj-33cg-xc48 x_refsource_CONFIRM
• https://github.com/danielgatis/rembg/commit/7c76d3cdc5757ffbda6a76664b24cfbecdb80273 x_refsource_MISC
• https://github.com/danielgatis/rembg/releases/tag/v2.0.75 x_refsource_MISC

---

rembg

• ==< 2.0.75

NIXPKGS-2026-1050

GitHub issue published 5 months ago

Permalink CVE-2026-40023

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters

• https://github.com/apache/logging-log4cxx/pull/609 patch
• https://logging.apache.org/security.html#CVE-2026-40023 vendor-advisory
• https://lists.apache.org/thread/y15cv3zblg3dfwr5vy6ddbnl4zyrzr8b vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/04/10/12

Ignored references (2)

• https://logging.apache.org/cyclonedx/vdr.xml vendor-advisory
• https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html related

---

log4cxx

• <1.7.0

Apache Log4cxx

• <1.7.0