NIXPKGS-2026-0824

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33205

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
3 packages
- calibre-web
- pkgsRocm.calibre-no-speech
- calibre-no-speech
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

calibre has Server-Side Request Forgery in ebook viewer backend

https://github.com/kovidgoyal/calibre/security/advisories/GHSA-4926-v9px-wv7v x_refsource_CONFIRM

calibre

==< 9.6.0

Advisory: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-4926-v9px-wv7v

NIXPKGS-2026-0822

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-4985
          
        4.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): Low (L)
        
          Exploit Code Maturity (E): Not Defined (X)
        
          Remediation Level (RL): Official Fix (O)
        
          Report Confidence (RC): Confirmed (C)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          5 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 2 weeks ago
          
            dloebl CGIF GIF Image cgif.c cgif_addframe integer overflow
          
      VDB-353874 | dloebl CGIF GIF Image cgif.c cgif_addframe integer overflow
    
    technical-descriptionvdb-entry
  
      VDB-353874 | CTI Indicators (IOB, IOC, IOA)
    
    permissions-requiredsignature
  
      Submit #778278 | dloebl CGIF   v0.4.0 to v0.5.2  Integer Overflow
    
    third-party-advisory
  
      https://github.com/dloebl/cgif/issues/110
    
    issue-tracking
  
      https://github.com/dloebl/cgif/pull/112
    
    patchissue-tracking
  
      https://github.com/dloebl/cgif/commit/b0ba830093f4317a5d1f345715d2fa3cd2dab474
    
    patch
  
      https://github.com/dloebl/cgif/
    
    product
  
    CGIF

            ==0.5.0
          
            ==0.5.1
          
            ==0.5.2
          
            Patch: https://github.com/dloebl/cgif/commit/b0ba830093f4317a5d1f345715d2fa3cd2dab474

NIXPKGS-2026-0820

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33744

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

https://github.com/bentoml/BentoML/security/advisories/GHSA-jfjg-vc52-wqvf x_refsource_CONFIRM

BentoML

==< 1.4.37

Advisory: https://github.com/bentoml/BentoML/security/advisories/GHSA-jfjg-vc52-wqvf

NIXPKGS-2026-0818

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33699
          
              updated
            
          5 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                capypdf
python312Packages.pypdfium2
python313Packages.pypdfium2
python314Packages.pypdfium2

          5 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 2 weeks ago
          
            pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream
          
      https://github.com/py-pdf/pypdf/security/advisories/GHSA-87mj-5ggw-8qc3
    
    x_refsource_CONFIRM
  
      https://github.com/py-pdf/pypdf/pull/3693
    
    x_refsource_MISC
  
      https://github.com/py-pdf/pypdf/releases/tag/6.9.2
    
    x_refsource_MISC
  
    pypdf

            ==< 6.9.2
          
            Advisory: https://github.com/py-pdf/pypdf/security/advisories/GHSA-87mj-5ggw-8qc3

NIXPKGS-2026-0836

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-26061

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
20 packages
- fleetctl
- fleeting-plugin-aws
- azure-cli-extensions.fleet
- python312Packages.tesla-fleet-api
- python313Packages.tesla-fleet-api
- python314Packages.tesla-fleet-api
- haskellPackages.amazonka-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python312Packages.mypy-boto3-iotfleethub
- python313Packages.mypy-boto3-iotfleethub
- python314Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleetwise
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleetwise
- home-assistant-component-tests.tesla_fleet
- python312Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleethub
- python312Packages.types-aiobotocore-iotfleetwise
- python313Packages.types-aiobotocore-iotfleetwise
- tests.home-assistant-component-tests.tesla_fleet
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Fleet's unbounded request body read allows remote Denial of Service

https://github.com/fleetdm/fleet/security/advisories/GHSA-99hj-44vg-hfcp x_refsource_CONFIRM

fleet

==< 4.81.0

Advisory: https://github.com/fleetdm/fleet/security/advisories/GHSA-99hj-44vg-hfcp

NIXPKGS-2026-0831

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-26060

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
20 packages
- fleetctl
- fleeting-plugin-aws
- azure-cli-extensions.fleet
- python312Packages.tesla-fleet-api
- python313Packages.tesla-fleet-api
- python314Packages.tesla-fleet-api
- haskellPackages.amazonka-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python312Packages.mypy-boto3-iotfleethub
- python313Packages.mypy-boto3-iotfleethub
- python314Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleetwise
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleetwise
- home-assistant-component-tests.tesla_fleet
- python312Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleethub
- python312Packages.types-aiobotocore-iotfleetwise
- python313Packages.types-aiobotocore-iotfleetwise
- tests.home-assistant-component-tests.tesla_fleet
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Fleet: Password reset tokens remain valid after password change for 24 hours

https://github.com/fleetdm/fleet/security/advisories/GHSA-3458-r943-hmx4 x_refsource_CONFIRM

fleet

==< 4.81.0

Advisory: https://github.com/fleetdm/fleet/security/advisories/GHSA-3458-r943-hmx4

NIXPKGS-2026-0829

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-34391

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
20 packages
- fleetctl
- fleeting-plugin-aws
- azure-cli-extensions.fleet
- python312Packages.tesla-fleet-api
- python313Packages.tesla-fleet-api
- python314Packages.tesla-fleet-api
- haskellPackages.amazonka-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python312Packages.mypy-boto3-iotfleethub
- python313Packages.mypy-boto3-iotfleethub
- python314Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleetwise
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleetwise
- home-assistant-component-tests.tesla_fleet
- python312Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleethub
- python312Packages.types-aiobotocore-iotfleetwise
- python313Packages.types-aiobotocore-iotfleetwise
- tests.home-assistant-component-tests.tesla_fleet
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Fleet Vulnerable to Windows MDM cross-device command disclosure

https://github.com/fleetdm/fleet/security/advisories/GHSA-wg7j-pcc3-h4rh x_refsource_CONFIRM

fleet

==< 4.81.1

Advisory: https://github.com/fleetdm/fleet/security/advisories/GHSA-wg7j-pcc3-h4rh

NIXPKGS-2026-0827

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33881

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor

https://github.com/windmill-labs/windmill/security/advisories/GHSA-8q8j-mm3g-5c2q x_refsource_CONFIRM

windmill

==< 1.664.0

Advisory: https://github.com/windmill-labs/windmill/security/advisories/GHSA-8q8j-mm3g-5c2q

NIXPKGS-2026-0825

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33206

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored package calibre-web 5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

calibre has a path traversal vulnerability

https://github.com/kovidgoyal/calibre/security/advisories/GHSA-h3p4-m74f-43g6 x_refsource_CONFIRMexploit

calibre

==< 9.6.0

Advisory: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-h3p4-m74f-43g6

NIXPKGS-2026-0823

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-32695
          
              updated
            
          5 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              package traefik-certs-dumper
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 2 weeks ago
          
            Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
          
      https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rj
    
    x_refsource_CONFIRM
  
      https://github.com/traefik/traefik/releases/tag/v3.6.11
    
    x_refsource_MISC
  
      https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2
    
    x_refsource_MISC
  
    traefik

            ==>= 3.7.0-ea.1, < 3.7.0-ea.2
          
            ==< 3.6.11
          
            Advisory: https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rj

Nixpkgs security tracker

Published issues

calibre has Server-Side Request Forgery in ebook viewer backend

dloebl CGIF GIF Image cgif.c cgif_addframe integer overflow

BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

Fleet's unbounded request body read allows remote Denial of Service

Fleet: Password reset tokens remain valid after password change for 24 hours

Fleet Vulnerable to Windows MDM cross-device command disclosure

Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor

calibre has a path traversal vulnerability

Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass