NIXPKGS-2026-0939

GitHub issue published 5 months, 2 weeks ago

          Permalink
          
            CVE-2026-34531
          
        6.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          5 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 2 weeks ago
          
            Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client
          
      https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg
    
    x_refsource_CONFIRM
  
      https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee
    
    x_refsource_MISC
  
      https://github.com/miguelgrinberg/Flask-HTTPAuth/releases/tag/v4.8.1
    
    x_refsource_MISC
  
    Flask-HTTPAuth

            ==< 4.8.1
          
            Advisory: https://github.com/miguelgrinberg/Flask-HTTPAuth/security/advisories/GHSA-p44q-vqpr-4xmg
Patch: https://github.com/miguelgrinberg/flask-httpauth/commit/b15ffe9e50e110d7174ccd944f642079e1dcf9ee

NIXPKGS-2026-0938

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-4370

10.0 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
2 packages
- jujutsu
- jujuutils
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Improper TLS Client/Server authentication and certificate verification on Database Cluster

https://github.com/juju/juju/security/advisories/GHSA-gvrj-cjch-728p

juju

<3.6.20
<4.0.4

Advisory: https://github.com/juju/juju/security/advisories/GHSA-gvrj-cjch-728p

NIXPKGS-2026-0937

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-34222

7.7 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Open WebUI has Broken Access Control in Tool Valves

https://github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m x_refsource_CONFIRM
https://github.com/open-webui/open-webui/releases/tag/v0.8.11 x_refsource_MISC

open-webui

==< 0.8.11

Advisory: https://github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m

NIXPKGS-2026-0936

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-34529

7.6 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
4 packages
- filebrowser-quantum
- python312Packages.filebrowser-safe
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5vpr-4fgw-f69h x_refsource_CONFIRM
https://github.com/filebrowser/filebrowser/releases/tag/v2.62.2 x_refsource_MISC

filebrowser

==< 2.62.2

Advisory: https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5vpr-4fgw-f69h

NIXPKGS-2026-0910

GitHub issue published 5 months, 2 weeks ago

          Permalink
          
            CVE-2026-32714
          
        9.8 CRITICAL
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 2 weeks ago
          
            SciTokens vulnerable to SQL Injection in KeyCache
          
      https://github.com/scitokens/scitokens/security/advisories/GHSA-rh5m-2482-966c
    
    x_refsource_CONFIRMexploit
  
      https://github.com/scitokens/scitokens/commit/3dba108853f2f4a6c0f2325c03779bf083c41cf2
    
    x_refsource_MISC
  
      https://github.com/scitokens/scitokens/releases/tag/v1.9.6
    
    x_refsource_MISC
  
    scitokens

            ==< 1.9.6
          
            Advisory: https://github.com/scitokens/scitokens/security/advisories/GHSA-rh5m-2482-966c
Patch: https://github.com/scitokens/scitokens/commit/3dba108853f2f4a6c0f2325c03779bf083c41cf2

NIXPKGS-2026-0909

GitHub issue published 5 months, 2 weeks ago

          Permalink
          
            CVE-2026-32716
          
        8.1 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          5 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 2 weeks ago
          
            SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking
          
      https://github.com/scitokens/scitokens/security/advisories/GHSA-w8fp-g9rh-34jh
    
    x_refsource_CONFIRM
  
      https://github.com/scitokens/scitokens/commit/7a237c0f642efb9e8c36ac564b745895cca83583
    
    x_refsource_MISC
  
      https://github.com/scitokens/scitokens/releases/tag/v1.9.6
    
    x_refsource_MISC
  
    scitokens

            ==< 1.9.6
          
            Advisory: https://github.com/scitokens/scitokens/security/advisories/GHSA-w8fp-g9rh-34jh
Patch: https://github.com/scitokens/scitokens/commit/7a237c0f642efb9e8c36ac564b745895cca83583

NIXPKGS-2026-0908

GitHub issue published 5 months, 2 weeks ago

          Permalink
          
            CVE-2026-34200
          
              updated
            
          5 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 2 weeks ago
          
            Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port
          
      https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2
    
    exploitx_refsource_CONFIRM
  
      https://github.com/nhost/nhost/pull/4060
    
    x_refsource_MISC
  
      https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9
    
    x_refsource_MISC
  
    nhost

            ==< 1.41.0
          
            Advisory: https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2
Patch: https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9

NIXPKGS-2026-0907

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-34073

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
14 packages
- python312Packages.django-cryptography
- python313Packages.django-cryptography
- python314Packages.django-cryptography
- python312Packages.mypy-boto3-payment-cryptography
- python313Packages.mypy-boto3-payment-cryptography
- python314Packages.mypy-boto3-payment-cryptography
- python312Packages.mypy-boto3-payment-cryptography-data
- python313Packages.mypy-boto3-payment-cryptography-data
- python314Packages.mypy-boto3-payment-cryptography-data
- python312Packages.types-aiobotocore-payment-cryptography
- python313Packages.types-aiobotocore-payment-cryptography
- python312Packages.types-aiobotocore-payment-cryptography-data
- python314Packages.cryptography
- python313Packages.types-aiobotocore-payment-cryptography-data
5 months, 2 weeks ago
@LeSuisse restored package python314Packages.cryptography 5 months, 2 weeks ago
@LeSuisse deleted
2 maintainers
- @SuperSandro2000
- @mdaniels5757
5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

cryptography has incomplete DNS name constraint enforcement on peer names

https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43 x_refsource_CONFIRM

cryptography

==< 46.0.6

https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43

NIXPKGS-2026-0906

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-33300

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 2 weeks ago
@LeSuisse deleted maintainer @talyz 5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint

https://github.com/discourse/discourse/security/advisories/GHSA-wrwm-vqx2-6x4v x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/07f66658cce81a099a0d7115db5f3c69f5d3cca2 x_refsource_MISC

discourse

==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.3.0-latest, < 2026.3.0

https://github.com/discourse/discourse/security/advisories/GHSA-wrwm-vqx2-6x4v

NIXPKGS-2026-0905

GitHub issue published 5 months, 2 weeks ago

Permalink CVE-2026-33185

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 2 weeks ago
@LeSuisse deleted maintainer @talyz 5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Discourse: Group SMTP test endpoint susceptible to SSRF

https://github.com/discourse/discourse/security/advisories/GHSA-5976-77mj-m4h3 x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/e75cf456e8e318290c569bd6e8fa0f2586ffc530 x_refsource_MISC

discourse

==>= 2026.2.0-latest, < 2026.2.2
==>= 2026.1.0-latest, < 2026.1.3
==>= 2026.3.0-latest, < 2026.3.0

https://github.com/discourse/discourse/security/advisories/GHSA-5976-77mj-m4h3

Nixpkgs security tracker

Published issues

Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

Improper TLS Client/Server authentication and certificate verification on Database Cluster

Open WebUI has Broken Access Control in Tool Valves

File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file

SciTokens vulnerable to SQL Injection in KeyCache

SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking

Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port

cryptography has incomplete DNS name constraint enforcement on peer names

Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint

Discourse: Group SMTP test endpoint susceptible to SSRF