NIXPKGS-2026-0803

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33945

9.9 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
3 packages
- terraform-providers.incus
- terraform-providers.lxc_incus
- incus-ui-canonical
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Abitrary file write through systemd-creds option

https://github.com/lxc/incus/security/advisories/GHSA-q4q8-7f2j-9h9f x_refsource_CONFIRM

incus

==< 6.23.0

Upstream advisory: https://github.com/lxc/incus/security/advisories/GHSA-q4q8-7f2j-9h9f

NIXPKGS-2026-0801

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33670

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

SiYuan has directory traversal within its publishing service

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xmw9-6r43-x9ww x_refsource_CONFIRM

siyuan

==< 3.6.2

Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xmw9-6r43-x9ww

NIXPKGS-2026-0799

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2014-125112

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution

https://gist.github.com/miyagawa/2b8764af908a0dacd43d technical-description
https://metacpan.org/release/MIYAGAWA/Plack-Middleware-Session-0.23-TRIAL/chang… release-notes
http://www.openwall.com/lists/oss-security/2026/03/26/2

Plack-Middleware-Session

=<0.21

Advisory: http://www.openwall.com/lists/oss-security/2026/03/26/2

NIXPKGS-2026-0797

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33526

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
5 packages
- prometheus-squid-exporter
- python312Packages.flyingsquid
- python313Packages.flyingsquid
- python314Packages.flyingsquid
- pkgsRocm.python3Packages.flyingsquid
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Squid vulnerable to Denial of Service in ICP Request handling

https://github.com/squid-cache/squid/security/advisories/GHSA-hpfx-h48q-gvwg x_refsource_CONFIRM
https://github.com/squid-cache/squid/commit/8a7d42f9d44befb8fcbbb619505587c8de6a1e91 x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/03/25/2

squid

==< 7.5

Upstream advisory: https://github.com/squid-cache/squid/security/advisories/GHSA-hpfx-h48q-gvwg

NIXPKGS-2026-0795

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33515
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                5 packages
                prometheus-squid-exporter
python312Packages.flyingsquid
python313Packages.flyingsquid
python314Packages.flyingsquid
pkgsRocm.python3Packages.flyingsquid

          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Squid has issues in ICP message handling
          
      https://github.com/squid-cache/squid/security/advisories/GHSA-84p4-hcx7-jj7c
    
    x_refsource_CONFIRM
  
      https://github.com/squid-cache/squid/pull/2220
    
    x_refsource_MISC
  
      https://github.com/squid-cache/squid/pull/2220#discussion_r2727683637
    
    x_refsource_MISC
  
      https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165
    
    x_refsource_MISC
  
      http://www.openwall.com/lists/oss-security/2026/03/25/4
    
    squid

            ==< 7.5
          
            Upstream advisory: https://github.com/squid-cache/squid/security/advisories/GHSA-84p4-hcx7-jj7c
Upstream patch: https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165

NIXPKGS-2026-0793

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-28503

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored package gnome-recipes 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404

https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-6qpw-gwcq-68fv x_refsource_CONFIRM
https://github.com/TandoorRecipes/recipes/releases/tag/2.6.0 x_refsource_MISC

recipes

==< 2.6.0

Upstream advisory: https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-6qpw-gwcq-68fv

NIXPKGS-2026-0791

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33494

10.0 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Ory Oathkeeper has a path traversal authorization bypass

https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm x_refsource_CONFIRM
https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2 x_refsource_MISC

oathkeeper

==< 26.2.0

Upstream advisory: https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm
Upstream patch: https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2

NIXPKGS-2026-0789

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33469

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored package home-assistant-custom-components.frigate 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw

https://github.com/blakeblackshear/frigate/security/advisories/GHSA-26g3-f8g8-9ffh x_refsource_CONFIRMexploit

frigate

=== 0.17.0

Upstream advisory: https://github.com/blakeblackshear/frigate/security/advisories/GHSA-26g3-f8g8-9ffh

NIXPKGS-2026-0787

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-32857
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation
          
      https://www.firecrawl.dev/
    
    product
  
      https://github.com/firecrawl/firecrawl/security/advisories/GHSA-vjp8-2wgg-p734
    
    related
  
      https://www.vulncheck.com/advisories/firecrawl-playwright-service-ssrf-protecti…
    
    third-party-advisory
  
    Firecrawl

            =<2.8.0
          
            Upstream advisory: https://github.com/firecrawl/firecrawl/security/advisories/GHSA-vjp8-2wgg-p734

NIXPKGS-2026-0784

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33536

5.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
8 packages
- imagemagick6
- imagemagickBig
- imagemagick6Big
- imagemagick_light
- imagemagick6_light
- graphicsmagick-imagemagick-compat
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

ImageMagick has an Out-of-bounds Write via InterpretImageFilename

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8793-7xv6-82cf x_refsource_CONFIRM

ImageMagick

==< 6.9.13-43
==< 7.1.2-18

Upstream advisory: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8793-7xv6-82cf

Nixpkgs security tracker

Published issues

Abitrary file write through systemd-creds option

SiYuan has directory traversal within its publishing service

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution

Squid vulnerable to Denial of Service in ICP Request handling

Squid has issues in ICP message handling

Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404

Ory Oathkeeper has a path traversal authorization bypass

Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw

Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation

ImageMagick has an Out-of-bounds Write via InterpretImageFilename