NIXPKGS-2026-1019

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-33753

6.2 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Improper Certificate Validation in rfc3161-client

https://github.com/trailofbits/rfc3161-client/security/advisories/GHSA-3xxc-pwj6-jgrj x_refsource_CONFIRMexploit

rfc3161-client

==< 1.0.6

NIXPKGS-2026-1018

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-39892

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
12 packages
- python312Packages.django-cryptography
- python313Packages.django-cryptography
- python312Packages.mypy-boto3-payment-cryptography
- python313Packages.mypy-boto3-payment-cryptography
- python314Packages.mypy-boto3-payment-cryptography
- python312Packages.mypy-boto3-payment-cryptography-data
- python313Packages.mypy-boto3-payment-cryptography-data
- python314Packages.mypy-boto3-payment-cryptography-data
- python312Packages.types-aiobotocore-payment-cryptography
- python313Packages.types-aiobotocore-payment-cryptography
- python312Packages.types-aiobotocore-payment-cryptography-data
- python313Packages.types-aiobotocore-payment-cryptography-data
5 months, 1 week ago
@LeSuisse deleted
2 maintainers
- @SuperSandro2000
- @mdaniels5757
5 months, 1 week ago maintainer.delete
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

cryptography

==>= 45.0.0, < 46.0.7

NIXPKGS-2026-1017

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35455

7.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
13 packages
- immich-go
- immich-cli
- immichframe
- immich-kiosk
- immich-public-proxy
- immich-machine-learning
- python312Packages.aioimmich
- python313Packages.aioimmich
- python314Packages.aioimmich
- gnomeExtensions.immich-wallpaper
- pkgsRocm.immich-machine-learning
- home-assistant-component-tests.immich
- tests.home-assistant-component-tests.immich
5 months, 1 week ago
@LeSuisse deleted
4 maintainers
- @Scrumplex
- @dotlambda
- @titaniumtown
- @jvanbruegge
5 months, 1 week ago maintainer.delete
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

immich has Stored XSS via OCR Text in 360° Panorama Viewer

https://github.com/immich-app/immich/security/advisories/GHSA-9qx4-67jm-cc66 x_refsource_CONFIRM

immich

==< 2.7.0

NIXPKGS-2026-1016

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-5600

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored package pretix-banktool 5 months, 1 week ago
@LeSuisse deleted maintainer @mweinelt 5 months, 1 week ago maintainer.delete
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

A new API endpoint introduced in pretix 2025 that is …

https://pretix.eu/about/en/blog/20260408-release-2026-3-1/

pretix

<2026.1.2
<2026.3.1
<2026.2.1

NIXPKGS-2026-1015

GitHub issue published 5 months, 1 week ago

          Permalink
          
            CVE-2026-40037
          
        6.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          5 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          5 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 1 week ago
          
            OpenClaw < 2026.3.31 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects
          
      GitHub Security Advisory (GHSA-qx8j-g322-qj6m)
    
    third-party-advisory
  
      Patch Commit
    
    patch
  
          Ignored references (1)
        
      VulnCheck Advisory: OpenClaw < 2026.3.31 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects
    
    third-party-advisory
  
    OpenClaw

            ==2026.4.8
          
            <2026.3.31

NIXPKGS-2026-1014

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35519

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
5 packages
- swiftlint
- python312Packages.softlayer
- python313Packages.softlayer
- python314Packages.softlayer
- chickenPackages_5.chickenEggs.ftl
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection

https://github.com/pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp x_refsource_CONFIRM

FTL

==>= 6.0, < 6.6

NIXPKGS-2026-1013

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35463

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
5 packages
- python312Packages.pyloadapi
- python313Packages.pyloadapi
- python314Packages.pyloadapi
- home-assistant-component-tests.pyload
- tests.home-assistant-component-tests.pyload
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

pyLoad has Improper Neutralization of Special Elements used in an OS Command

https://github.com/pyload/pyload/security/advisories/GHSA-w48f-wwwf-f5fr x_refsource_CONFIRM
https://github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1 x_refsource_MISC

pyload

==<= 0.5.0b3.dev96

NIXPKGS-2026-1012

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35462

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Papra Does Not Reject Expired API Keys

https://github.com/papra-hq/papra/security/advisories/GHSA-866c-mc22-wvv5 x_refsource_CONFIRM

papra

==< 26.4.0

NIXPKGS-2026-1011

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-39846

9.0 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-phhp-9rm9-6gr2 x_refsource_CONFIRM

siyuan

==< 3.6.4

NIXPKGS-2026-1010

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-24450

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored package libraw1394 5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of …

LibRaw

==Commit 8dc68e2

Patch: https://github.com/LibRaw/LibRaw/commit/a58727c1a3cfef4101700e546a6a661c6a299d97

Nixpkgs security tracker

Published issues

Improper Certificate Validation in rfc3161-client

cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

immich has Stored XSS via OCR Text in 360° Panorama Viewer

A new API endpoint introduced in pretix 2025 that is …

OpenClaw < 2026.3.31 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection

pyLoad has Improper Neutralization of Special Elements used in an OS Command

Papra Does Not Reject Expired API Keys

SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

An integer overflow vulnerability exists in the uncompressed_fp_dng_load_raw functionality of …