NIXPKGS-2026-0821

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33748
          
              updated
            
          5 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                7 packages
                buildkit-nix
buildkite-cli
buildkite-agent
buildkite-agent-metrics
buildkite-test-collector-rust
terraform-providers.buildkite
terraform-providers.buildkite_buildkite

          5 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 2 weeks ago
          
            BuildKit Git URL subdir component can cause access to restricted files
          
      https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg
    
    x_refsource_CONFIRM
  
      https://docs.docker.com/build/concepts/context/#url-fragments
    
    x_refsource_MISC
  
      https://github.com/moby/buildkit/releases/tag/v0.28.1
    
    x_refsource_MISC
  
    buildkit

            ==< 0.28.1
          
            Advisory: https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg

NIXPKGS-2026-0819

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33747

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
7 packages
- buildkit-nix
- buildkite-cli
- buildkite-agent
- buildkite-agent-metrics
- buildkite-test-collector-rust
- terraform-providers.buildkite
- terraform-providers.buildkite_buildkite
5 months, 2 weeks ago
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

BuildKit vulnerable to malicious frontend causing file escape outside of storage root

https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj x_refsource_CONFIRM
https://github.com/moby/buildkit/releases/tag/v0.28.1 x_refsource_MISC

buildkit

==< 0.28.1

Advisory: https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj

NIXPKGS-2026-0817

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-32241

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored package cni-plugin-flannel 5 months, 2 weeks ago
@LeSuisse deleted maintainer @offlinehacker 5 months, 2 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 2 weeks ago
@LeSuisse published on GitHub 5 months, 2 weeks ago

Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection

https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2 x_refsource_CONFIRM
https://github.com/flannel-io/flannel/releases/tag/v0.28.2 x_refsource_MISC

flannel

==< 0.28.2

Advisory: https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2

NIXPKGS-2026-0806

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33738
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                LycheeSlicer
lycheeslicer
tests.testers.lycheeLinkCheck.ok
tests.testers.lycheeLinkCheck.network

          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)
          
      https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5574-7f3r-hm9j
    
    x_refsource_CONFIRM
  
      https://github.com/LycheeOrg/Lychee/pull/4218
    
    x_refsource_MISC
  
      https://github.com/LycheeOrg/Lychee/commit/d2e2606a0223d5a384d5b806db1b31eb587adc5c
    
    x_refsource_MISC
  
      https://github.com/LycheeOrg/Lychee/releases/tag/v7.5.3
    
    x_refsource_MISC
  
    Lychee

            ==< 7.5.3
          
            Upstream advisory: https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5574-7f3r-hm9j
Upstream patch: https://github.com/LycheeOrg/Lychee/commit/d2e2606a0223d5a384d5b806db1b31eb587adc5c

NIXPKGS-2026-0810

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33470

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored package home-assistant-custom-components.frigate 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp

https://github.com/blakeblackshear/frigate/security/advisories/GHSA-m2mg-pj9p-2r7g x_refsource_CONFIRMexploit

frigate

=== 0.17.0

Upstream advisory: https://github.com/blakeblackshear/frigate/security/advisories/GHSA-m2mg-pj9p-2r7g

NIXPKGS-2026-0812

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-34071

5.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored package stirling-pdf-desktop 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export

https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-xmhg-fv84-jgfc x_refsource_CONFIRM

Stirling-PDF

=== 2.7.3

Upstream advisory: https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-xmhg-fv84-jgfc

NIXPKGS-2026-0814

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33496

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Ory Oathkeeper has an authentication bypass by cache key confusion

https://github.com/ory/oathkeeper/security/advisories/GHSA-4mq7-pvjg-xp2r x_refsource_CONFIRM
https://github.com/ory/oathkeeper/commit/198a2bc82a99e0a77bd0ffe290cbdd5285a1b17c x_refsource_MISC

oathkeeper

==< 26.2.0

Upstream advisory: https://github.com/ory/oathkeeper/security/advisories/GHSA-4mq7-pvjg-xp2r
Upstream patch: https://github.com/ory/oathkeeper/commit/198a2bc82a99e0a77bd0ffe290cbdd5285a1b17c

NIXPKGS-2026-0816

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33664

7.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields

https://github.com/kestra-io/kestra/security/advisories/GHSA-v2mc-8q95-g7hp x_refsource_CONFIRM

kestra

==<= 1.3.3

Upstream advisory: https://github.com/kestra-io/kestra/security/advisories/GHSA-v2mc-8q95-g7hp

NIXPKGS-2026-0777

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-2239
          
        2.8 LOW
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                28 packages
                zigimports
gimpPlugins.bimp
gimpPlugins.gimp
gimpPlugins.gmic
gimp-with-plugins
gimp2Plugins.bimp
gimp2Plugins.gimp
gimp2Plugins.gmic
gimp3Plugins.gimp
gimp3Plugins.gmic
gimp2-with-plugins
gimp3-with-plugins
gimpPlugins.fourier
gimp2Plugins.fourier
gimpPlugins.farbfeld
gimp2Plugins.farbfeld
gimpPlugins.lightning
gimpPlugins.lqrPlugin
gimpPlugins.texturize
gimp2Plugins.lightning
gimp2Plugins.lqrPlugin
gimp2Plugins.texturize
gimp3Plugins.lightning
gimpPlugins.gimplensfun
gimp2Plugins.gimplensfun
gimpPlugins.resynthesizer
gimpPlugins.waveletSharpen
gimp2Plugins.waveletSharpen

          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow
          
      https://access.redhat.com/security/cve/CVE-2026-2239
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2437675
    
    x_refsource_REDHATissue-tracking
  
      https://gitlab.gnome.org/GNOME/gimp/-/issues/15812
    
    gimp

    gimp:2.8/gimp

            Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/15812

NIXPKGS-2026-0778

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33495

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Ory Oathkeeper has an authentication bypass by usage of untrusted header

https://github.com/ory/oathkeeper/security/advisories/GHSA-vhr5-ggp3-qq85 x_refsource_CONFIRM
https://github.com/ory/oathkeeper/commit/e9acca14a04d246250557550065e4b4576525bd5 x_refsource_MISC

oathkeeper

==< 26.2.0

Upstream advisory: https://github.com/ory/oathkeeper/security/advisories/GHSA-vhr5-ggp3-qq85
Upstream patch: https://github.com/ory/oathkeeper/commit/e9acca14a04d246250557550065e4b4576525bd5

Nixpkgs security tracker

Published issues

BuildKit Git URL subdir component can cause access to restricted files

BuildKit vulnerable to malicious frontend causing file escape outside of storage root

Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection

Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint)

Frigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp

Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export

Ory Oathkeeper has an authentication bypass by cache key confusion

Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields

Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow

Ory Oathkeeper has an authentication bypass by usage of untrusted header