NIXPKGS-2026-1039

GitHub issue published 5 months, 1 week ago

          Permalink
          
            CVE-2026-28500
          
        8.6 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          5 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              ignored
            
                47 packages
                onnxruntime
sherpa-onnx
pkgsRocm.onnxruntime
pkgsRocm.sherpa-onnx
python312Packages.onnx
python312Packages.tf2onnx
python313Packages.onnx-ir
python313Packages.tf2onnx
python314Packages.onnx-ir
python312Packages.onnxslim
python312Packages.skl2onnx
python313Packages.onnx-asr
python313Packages.onnxslim
python313Packages.skl2onnx
python314Packages.onnx-asr
python314Packages.onnxslim
python314Packages.skl2onnx
python313Packages.onnxscript
python314Packages.onnxscript
python312Packages.onnxmltools
python312Packages.onnxruntime
python312Packages.paddle2onnx
python313Packages.onnxmltools
python313Packages.onnxruntime
python313Packages.sherpa-onnx
python314Packages.onnxmltools
python314Packages.onnxruntime
python314Packages.sherpa-onnx
python313Packages.optimum-onnx
python314Packages.optimum-onnx
pkgsRocm.python3Packages.onnx-ir
pkgsRocm.python3Packages.tf2onnx
pkgsRocm.python3Packages.onnx-asr
pkgsRocm.python3Packages.onnxscript
python312Packages.onnxruntime-tools
python313Packages.onnxruntime-tools
python314Packages.onnxruntime-tools
pkgsRocm.python3Packages.onnxruntime
pkgsRocm.python3Packages.sherpa-onnx
pkgsRocm.python3Packages.optimum-onnx
python312Packages.onnxconverter-common
python312Packages.rapidocr-onnxruntime
python313Packages.onnxconverter-common
python313Packages.rapidocr-onnxruntime
python314Packages.onnxconverter-common
python314Packages.rapidocr-onnxruntime
pkgsRocm.python3Packages.rapidocr-onnxruntime

          5 months, 1 week ago
          
          @LeSuisse
          
              restored
            
              package python312Packages.onnx
            
          5 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          5 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 1 week ago
          
            ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
          
      https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m
    
    x_refsource_CONFIRM
  
          Ignored references (1)
        
      https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md
    
    x_refsource_MISCexploit
  
    onnx

            ==<= 1.20.1

NIXPKGS-2026-1038

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35043

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

BentoML: command injection in cloud deployment setup script (deployment.py)

https://github.com/bentoml/BentoML/security/advisories/GHSA-fgv4-6jr3-jgfw x_refsource_CONFIRM

BentoML

==< 1.4.38

NIXPKGS-2026-1037

GitHub issue published 5 months, 1 week ago

          Permalink
          
            CVE-2026-34612
          
        9.9 CRITICAL
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          5 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 1 week ago
          
            Kestra: Remote Code Execution via SQL Injection
          
      https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x
    
    x_refsource_CONFIRM
  
      https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3
    
    x_refsource_MISC
  
      https://github.com/kestra-io/kestra/releases/tag/v1.3.7
    
    x_refsource_MISC
  
    kestra

            ==< 1.3.7

NIXPKGS-2026-1036

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-3029

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse ignored
6 packages
- python312Packages.pymupdf4llm
- python313Packages.pymupdf4llm
- python314Packages.pymupdf4llm
- python312Packages.pymupdf-fonts
- python313Packages.pymupdf-fonts
- python314Packages.pymupdf-fonts
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

CVE-2026-3029

PyMuPDF

<1.26.7

NIXPKGS-2026-1035

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-39863

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Kamailio Core: TCP Data Processing Vulnerability

https://github.com/kamailio/kamailio/security/advisories/GHSA-2wj4-f825-2h2f x_refsource_CONFIRM

kamailio

==< 5.8.8
==>= 6.1.0, < 6.1.1
==>= 6.0.0, < 6.0.6

NIXPKGS-2026-1034

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-39864

4.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Kamailio Auth: Processing Vulnerability For Additional Authenticated User Identity Checks

https://github.com/kamailio/kamailio/security/advisories/GHSA-6m86-m342-g48m x_refsource_CONFIRM

kamailio

==< 5.8.7
==>= 6.0.0, < 6.0.5

NIXPKGS-2026-1033

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-34723

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
3 packages
- python312Packages.zammad-py
- python313Packages.zammad-py
- python314Packages.zammad-py
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Zammad has incorrect access control in getting_started_controller

https://github.com/zammad/zammad/security/advisories/GHSA-hcm9-ch62-5727 x_refsource_CONFIRM

zammad

==>= 7.0.0-alpha, < 7.0.1
==< 6.5.4

NIXPKGS-2026-1032

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-34248

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
3 packages
- python312Packages.zammad-py
- python313Packages.zammad-py
- python314Packages.zammad-py
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Zammad has an information disclosure in ticket detail view of customers in shared organizations

https://github.com/zammad/zammad/security/advisories/GHSA-prww-84vh-w978 x_refsource_CONFIRM

zammad

==>= 7.0.0, < 7.0.1

NIXPKGS-2026-1031

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-34722

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
3 packages
- python312Packages.zammad-py
- python313Packages.zammad-py
- python314Packages.zammad-py
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Zammad is missing authorization in ticket create endpoint

https://github.com/zammad/zammad/security/advisories/GHSA-28m3-wwgv-ppw8 x_refsource_CONFIRM

zammad

==>= 7.0.0-alpha, < 7.0.1
==< 6.5.4

NIXPKGS-2026-1030

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-34724

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
3 packages
- python312Packages.zammad-py
- python313Packages.zammad-py
- python314Packages.zammad-py
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Zammad has a server-side template injection leading to RCE via AI Agent

https://github.com/zammad/zammad/security/advisories/GHSA-fg9w-jg8f-4j94 x_refsource_CONFIRM

zammad

==>= 7.0.0, < 7.0.1

Nixpkgs security tracker

Published issues

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

BentoML: command injection in cloud deployment setup script (deployment.py)

Kestra: Remote Code Execution via SQL Injection

CVE-2026-3029

Kamailio Core: TCP Data Processing Vulnerability

Kamailio Auth: Processing Vulnerability For Additional Authenticated User Identity Checks

Zammad has incorrect access control in getting_started_controller

Zammad has an information disclosure in ticket detail view of customers in shared organizations

Zammad is missing authorization in ticket create endpoint

Zammad has a server-side template injection leading to RCE via AI Agent