NIXPKGS-2026-1049

GitHub issue published 5 months ago

Permalink CVE-2026-5412

9.9 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  2 packages

  • jujutsu
  • jujuutils
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Juju CloudSpec API could leak senstive information

• CloudSpec method leaking cloud credentials vendor-advisoryvdb-entry
• https://github.com/juju/juju/pull/22206 patchissue-tracking
• https://github.com/juju/juju/pull/22205 patchissue-tracking

---

juju

• <2.9.57
• <3.6.21

NIXPKGS-2026-1048

GitHub issue published 5 months ago

Permalink CVE-2026-40199

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass

• https://github.com/stigtsp/Net-CIDR-Lite/commit/b7166b1fa17b3b14b4c795ace5b3fbf… patch
• https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes release-notes
• https://www.cve.org/CVERecord?id=CVE-2026-40198 related

---

Net-CIDR-Lite

• <0.23

NIXPKGS-2026-1047

GitHub issue published 5 months ago

Permalink CVE-2026-35594

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84 x_refsource_CONFIRM
• https://github.com/go-vikunja/vikunja/pull/2581 x_refsource_MISC
• https://github.com/go-vikunja/vikunja/commit/379d8a5c19334ffe4846003f590e202c31a75479 x_refsource_MISC

Ignored references (1)

• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC

---

vikunja

• ==< 2.3.0

NIXPKGS-2026-1046

GitHub issue published 5 months ago

Permalink CVE-2026-35601

4.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored package vikunja-desktop 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r x_refsource_CONFIRM
• https://github.com/go-vikunja/vikunja/pull/2580 x_refsource_MISC

Ignored references (1)

• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC

---

vikunja

• ==< 2.3.0

NIXPKGS-2026-1045

GitHub issue published 5 months ago

Permalink CVE-2026-35599

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored package vikunja-desktop 5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r4fg-73rc-hhh7 x_refsource_CONFIRM
• https://github.com/go-vikunja/vikunja/pull/2577 x_refsource_MISC
• https://github.com/go-vikunja/vikunja/commit/6df0d6c8f54b01db6464c42810e40e55f12b481b x_refsource_MISC

Ignored references (1)

• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC

---

vikunja

• ==< 2.3.0

NIXPKGS-2026-1044

GitHub issue published 5 months ago

Permalink CVE-2026-40071

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse ignored
  5 packages

  • tests.home-assistant-component-tests.pyload
  • home-assistant-component-tests.pyload
  • python314Packages.pyloadapi
  • python313Packages.pyloadapi
  • python312Packages.pyloadapi
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions

• https://github.com/pyload/pyload/security/advisories/GHSA-rfgh-63mg-8pwm x_refsource_CONFIRM

---

pyload

• ==< 0.5.0b3.dev97

NIXPKGS-2026-1043

GitHub issue published 5 months ago

Permalink CVE-2026-39957

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • tests.testers.lycheeLinkCheck.ok
  • tests.testers.lycheeLinkCheck.network
  • lychee
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users

• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-4v4c-g2jv-4g25 x_refsource_CONFIRM
• https://github.com/LycheeOrg/Lychee/pull/4264 x_refsource_MISC
• https://github.com/LycheeOrg/Lychee/commit/76a3f0513eca6458bf7f8c337c1ad65e59b22bcb x_refsource_MISC

---

Lychee

• ==< 7.5.4

NIXPKGS-2026-1042

GitHub issue published 5 months ago

Permalink CVE-2026-5504

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months, 1 week ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

PKCS7 CBC Padding Oracle — Plaintext Recovery

• https://github.com/wolfSSL/wolfssl/pull/10088

---

wolfSSL

• =<5.9.0

NIXPKGS-2026-1041

GitHub issue published 5 months ago

Permalink CVE-2026-40225

6.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Physical (P)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Physical (P)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 months ago by @LeSuisse Activity log

• Created suggestion 5 months ago
• @LeSuisse ignored
  2 packages

  • udev
  • rofi-systemd
  5 months ago
• @LeSuisse restored package udev 5 months ago
• @LeSuisse ignored
  43 packages

  • tests.pkg-config.defaultPkgConfigPackages.libsystemd
  • tests.pkg-config.defaultPkgConfigPackages.libudev
  • vscode-extensions.coolbear.systemd-unit-file
  • gnomeExtensions.systemd-offline-update-indicator
  • python313Packages.jupyterhub-systemdspawner
  • python313Packages.systemdunitparser
  • systemd-lsp
  • haskellPackages.libsystemd-journal
  • python312Packages.systemdunitparser
  • python313Packages.systemd-python
  • python314Packages.jupyterhub-systemdspawner
  • ocamlPackages_latest.systemd
  • update-systemd-resolved
  • python312Packages.jupyterhub-systemdspawner
  • gnomeExtensions.systemd-status
  • python314Packages.systemdunitparser
  • python314Packages.systemd-python
  • python312Packages.systemd-python
  • ocamlPackages.systemd
  • php84Extensions.systemd
  • php85Extensions.systemd
  • php82Extensions.systemd
  • gnomeExtensions.systemd-manager
  • prometheus-systemd-exporter
  • systemd
  • systemdgenie
  • systemdLibs
  • haskellPackages.warp-systemd
  • systemd-credsubst
  • systemd-journal2gelf
  • systemd-lock-handler
  • phpExtensions.systemd
  • haskellPackages.systemd
  • systemd-manager-tui
  • php83Extensions.systemd
  • systemd-bootchart
  • systemdMinimal
  • systemd-netlogd
  • systemd-wait
  • systemd-language-server
  • haskellPackages.systemd-api
  • nagiosPlugins.check_systemd
  • systemdUkify
  5 months ago
• @LeSuisse accepted 5 months ago
• @LeSuisse published on GitHub 5 months ago

In udev in systemd before 260, local root execution can …

• https://github.com/systemd/systemd/security/advisories/GHSA-vpfq-8p5f-jcqx

---

systemd

• <260

NIXPKGS-2026-1040

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-32596

updated 5 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 5 months, 4 weeks ago
• @LeSuisse ignored
  5 packages

  • python312Packages.glances-api
  • python313Packages.glances-api
  • python314Packages.glances-api
  • home-assistant-component-tests.glances
  • tests.home-assistant-component-tests.glances
  5 months, 1 week ago
• @LeSuisse accepted 5 months, 1 week ago
• @LeSuisse added maintainer @MiniHarinn 5 months, 1 week ago maintainer.add
• @LeSuisse published on GitHub 5 months, 1 week ago

Glances exposes the REST API without authentication

• https://github.com/nicolargo/glances/security/advisories/GHSA-wvxv-4j8q-4wjq x_refsource_CONFIRM
• https://github.com/nicolargo/glances/commit/208d876118fea5758970f33fd7474908bd403d25 x_refsource_MISC

Ignored references (1)

• https://github.com/nicolargo/glances/releases/tag/v4.5.2 x_refsource_MISC

---

glances

• ==< 4.5.2