NIXPKGS-2026-0989

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35611

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Addressable has a Regular Expression Denial of Service in Addressable templates

https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4 x_refsource_CONFIRM

addressable

==>= 2.3.0, < 2.9.0

NIXPKGS-2026-0988

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-39365

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
7 packages
- vite
- vitess
- vitetris
- python312Packages.django-vite
- python313Packages.django-vite
- python314Packages.django-vite
- vscode-extensions.vitest.explorer
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Vite has a Path Traversal in Optimized Deps `.map` Handling

https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9 x_refsource_CONFIRM

vite

==>= 8.0.0, < 8.0.5
==>= 6.0.0, < 6.4.2
==>= 7.0.0, < 7.3.2

vite-plus

==< 0.1.16

NIXPKGS-2026-0987

GitHub issue published 5 months, 1 week ago

          Permalink
          
            CVE-2026-35464
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 1 week ago
          
          @LeSuisse
          
              ignored
            
                5 packages
                python312Packages.pyloadapi
python313Packages.pyloadapi
python314Packages.pyloadapi
home-assistant-component-tests.pyload
tests.home-assistant-component-tests.pyload

          5 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          5 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 1 week ago
          
            pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution
          
      https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j
    
    x_refsource_CONFIRMexploit
  
      https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxx
    
    x_refsource_MISC
  
      https://github.com/pyload/pyload/commit/c4cf995a2803bdbe388addfc2b0f323277efc0e1
    
    x_refsource_MISC
  
          Ignored references (1)
        
      https://www.cve.org/CVERecord?id=CVE-2026-33509
    
    x_refsource_MISC
  
    pyload

            ==<= 0.5.0b3.dev96

NIXPKGS-2026-0986

GitHub issue published 5 months, 1 week ago

          Permalink
          
            CVE-2026-35406
          
        6.2 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 1 week ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 1 week ago
          
          @LeSuisse
          
              accepted
            
          5 months, 1 week ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 1 week ago
          
            Aardvark-dns has incorrect error handling for malformed tcp packets
          
      https://github.com/containers/aardvark-dns/security/advisories/GHSA-hfpq-x728-986j
    
    x_refsource_CONFIRM
  
      https://github.com/containers/aardvark-dns/commit/3b49ea7b38bdea134b7f03256f2e13f44ce73bb1
    
    x_refsource_MISC
  
      https://github.com/containers/aardvark-dns/releases/tag/v1.17.1
    
    x_refsource_MISC
  
    aardvark-dns

            ==>= 1.16.0, < 1.17.1

NIXPKGS-2026-0985

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35517

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
5 packages
- swiftlint
- python312Packages.softlayer
- python313Packages.softlayer
- python314Packages.softlayer
- chickenPackages_5.chickenEggs.ftl
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

https://github.com/pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj x_refsource_CONFIRM

FTL

==>= 6.0, < 6.6

NIXPKGS-2026-0984

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35604

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
4 packages
- filebrowser-quantum
- python312Packages.filebrowser-safe
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

File Browser share links remain accessible after Share/Download permissions are revoked

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-v9w4-gm2x-6rvf x_refsource_CONFIRM
https://github.com/filebrowser/filebrowser/pull/5888 x_refsource_MISC

filebrowser

==< 2.63.1

NIXPKGS-2026-0983

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35458

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
3 packages
- python312Packages.gotenberg-client
- python313Packages.gotenberg-client
- python314Packages.gotenberg-client
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Gotenberg has a ReDoS via extraHttpHeaders scope feature

https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fmwg-qcqh-m992 x_refsource_CONFIRM

gotenberg

==<= 8.29.1

NIXPKGS-2026-0982

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35607

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
4 packages
- filebrowser-quantum
- python312Packages.filebrowser-safe
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7526-j432-6ppp x_refsource_CONFIRM
https://github.com/filebrowser/filebrowser/pull/5890 x_refsource_MISC

filebrowser

==< 2.63.1

NIXPKGS-2026-0980

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-20911

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored package libraw1394 5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality …

LibRaw

==Commit 0b56545
==Commit d20315b

Upstream patch: https://github.com/LibRaw/LibRaw/commit/a6734e867b19d75367c05f872ac26322464e3995

NIXPKGS-2026-0981

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-35461

5.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL

https://github.com/papra-hq/papra/security/advisories/GHSA-cjw7-qg95-58mq x_refsource_CONFIRM

papra

==< 26.4.0

Nixpkgs security tracker

Published issues

Addressable has a Regular Expression Denial of Service in Addressable templates

Vite has a Path Traversal in Optimized Deps `.map` Handling

pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution

Aardvark-dns has incorrect error handling for malformed tcp packets

Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

File Browser share links remain accessible after Share/Download permissions are revoked

Gotenberg has a ReDoS via extraHttpHeaders scope feature

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands

A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality …

Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL