Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0939
published 5 months, 2 weeks ago
Permalink CVE-2026-34531
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

Flask-HTTPAuth
  • ==< 4.8.1 
Advisory: https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg
Patch: https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee
NIXPKGS-2026-0938
published 5 months, 2 weeks ago
Permalink CVE-2026-4370
10.0 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored
    2 packages
    • jujutsu
    • jujuutils
    5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

Improper TLS Client/Server authentication and certificate verification on Database Cluster

juju
  • <3.6.20
  • <4.0.4 
Advisory: https://github.com/juju/juju/security/advisories/GHSA-gvrj-cjch-728p
NIXPKGS-2026-0937
published 5 months, 2 weeks ago
Permalink CVE-2026-34222
7.7 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

Open WebUI has Broken Access Control in Tool Valves

open-webui
  • ==< 0.8.11 
Advisory: https://github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m
NIXPKGS-2026-0936
published 5 months, 2 weeks ago
Permalink CVE-2026-34529
7.6 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored
    4 packages
    • filebrowser-quantum
    • python312Packages.filebrowser-safe
    • python313Packages.filebrowser-safe
    • python314Packages.filebrowser-safe
    5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file

filebrowser
  • ==< 2.62.2 
Advisory: https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5vpr-4fgw-f69h
NIXPKGS-2026-0927
published 5 months, 2 weeks ago
Permalink CVE-2026-34585
8.6 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution

siyuan
  • ==< 3.6.2 
Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg
NIXPKGS-2026-0926
published 5 months, 2 weeks ago
Permalink CVE-2026-34605
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )

siyuan
  • ==>= 3.6.0, < 3.6.2 
Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-73g7-86qr-jrg3
NIXPKGS-2026-0925
published 5 months, 2 weeks ago
Permalink CVE-2026-34449
9.6 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

siyuan
  • ==< 3.6.2 
Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-68p4-j234-43mv
NIXPKGS-2026-0924
published 5 months, 2 weeks ago
Permalink CVE-2026-34453
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content

siyuan
  • ==< 3.6.2 
Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c77m-r996-jr3q
NIXPKGS-2026-0923
published 5 months, 2 weeks ago
Permalink CVE-2026-34448
9.0 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client

siyuan
  • ==< 3.6.2 
Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rx4h-526q-4458
NIXPKGS-2026-0922
published 5 months, 2 weeks ago
Permalink CVE-2026-32726
8.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

SciTokens C++: Sibling-Path Authorization Bypass

scitokens-cpp
  • ==< 1.4.1 
Advisory: https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-q5fm-fgvx-32jq
Patch: https://github.com/scitokens/scitokens-cpp/commit/decfe2f00cb9cabbf1e17a3bb2cd4ea1bbbd8a73