NIXPKGS-2026-0781

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33413

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
28 packages
- netcdf
- pnetcdf
- etcd_3_4
- etcd_3_5
- netcdf-mpi
- netcdfcxx4
- netcdffortran
- pkgsRocm.pnetcdf
- pkgsRocm.netcdf-mpi
- octavePackages.netcdf
- python312Packages.etcd
- python313Packages.etcd
- python314Packages.etcd
- python312Packages.aetcd
- python312Packages.etcd3
- python313Packages.aetcd
- python313Packages.etcd3
- python314Packages.aetcd
- python314Packages.etcd3
- python312Packages.netcdf4
- python313Packages.netcdf4
- python314Packages.netcdf4
- python312Packages.h5netcdf
- python313Packages.h5netcdf
- python314Packages.h5netcdf
- python312Packages.python-etcd
- python313Packages.python-etcd
- python314Packages.python-etcd
5 months, 3 weeks ago
@LeSuisse restored
2 packages
- etcd_3_4
- etcd_3_5
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

etcd: Authorization bypasses in multiple APIs

https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg x_refsource_CONFIRM

etcd

==< 3.4.42
==>= 3.6.0-alpha.0, < 3.6.9
==>= 3.5.0-alpha.0, < 3.5.28

Upstream advisory: https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg

NIXPKGS-2026-0780

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-32748

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
5 packages
- prometheus-squid-exporter
- python312Packages.flyingsquid
- python313Packages.flyingsquid
- python314Packages.flyingsquid
- pkgsRocm.python3Packages.flyingsquid
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Squid has Denial of Service in ICP Response handling

https://github.com/squid-cache/squid/security/advisories/GHSA-f9p7-3jqg-hhvq x_refsource_CONFIRM
https://github.com/squid-cache/squid/commit/703e07d25ca6fa11f52d20bf0bb879e22ab7481b x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/03/25/3

squid

==< 7.5

Upstream advisory: https://github.com/squid-cache/squid/security/advisories/GHSA-f9p7-3jqg-hhvq
Upstream patch: https://github.com/squid-cache/squid/commit/703e07d25ca6fa11f52d20bf0bb879e22ab7481b

NIXPKGS-2026-0779

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33898

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
3 packages
- incus-ui-canonical
- terraform-providers.incus
- terraform-providers.lxc_incus
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Local Incus UI web server vulnerable to nuthentication bypass

https://github.com/lxc/incus/security/advisories/GHSA-453r-g2pg-cxxq x_refsource_CONFIRM

incus

==< 6.23.0

Upstream advisory: https://github.com/lxc/incus/security/advisories/GHSA-453r-g2pg-cxxq

NIXPKGS-2026-0776

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33743

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
3 packages
- incus-ui-canonical
- terraform-providers.incus
- terraform-providers.lxc_incus
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Incus vulnerable to denial of source through crafted bucket backup file

https://github.com/lxc/incus/security/advisories/GHSA-vg76-xmhg-j5x3 x_refsource_CONFIRM

incus

==< 6.23.0

Upstream advisory: https://github.com/lxc/incus/security/advisories/GHSA-vg76-xmhg-j5x3

NIXPKGS-2026-0788

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33658
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
          
      https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
      https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml
    
    x_refsource_MISC
  
    activestorage

            ==>= 8.1.0, < 8.1.2.1
          
            ==>= 8.0.0, < 8.0.4.1
          
            ==< 7.2.3.1
          
            Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg

NIXPKGS-2026-0790

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33148

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored package gnome-recipes 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key

https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-43p3-wx6h-9g7w x_refsource_CONFIRM

recipes

==< 2.6.0

Upstream advisory: https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-43p3-wx6h-9g7w

NIXPKGS-2026-0792

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33669

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

SiYuan has Arbitrary Document Reading within the Publishing Service

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-34xj-66v3-6j83 x_refsource_CONFIRM

siyuan

==< 3.6.2

Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-34xj-66v3-6j83

NIXPKGS-2026-0794

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-28377

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
31 packages
- temporal
- tempora_lgc
- temporalite
- temporal-cli
- temporal_capi
- temporal-ui-server
- gnomeExtensions.tempomate
- haskellPackages.temporary
- python312Packages.tempora
- python313Packages.tempora
- python314Packages.tempora
- tests.haskell.incremental
- haskellPackages.temporary-rc
- python312Packages.temporalio
- python313Packages.temporalio
- python314Packages.temporalio
- haskellPackages.temporal-media
- terraform-providers.temporalcloud
- postgresqlPackages.temporal_tables
- haskellPackages.temporal-api-protos
- haskellPackages.temporary-resourcet
- postgresql13Packages.temporal_tables
- postgresql14Packages.temporal_tables
- postgresql15Packages.temporal_tables
- postgresql16Packages.temporal_tables
- postgresql17Packages.temporal_tables
- postgresql18Packages.temporal_tables
- haskellPackages.temporal-music-notation
- haskellPackages.temporal-music-notation-demo
- terraform-providers.temporalio_temporalcloud
- haskellPackages.temporal-music-notation-western
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)

https://grafana.com/security/security-advisories/cve-2026-28377 vendor-advisory

Tempo

==2.10.3

Upstream advisory: https://grafana.com/security/security-advisories/cve-2026-28377

NIXPKGS-2026-0796

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-2271
          
        3.3 LOW
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                28 packages
                zigimports
gimpPlugins.bimp
gimpPlugins.gimp
gimpPlugins.gmic
gimp-with-plugins
gimp2Plugins.bimp
gimp2Plugins.gimp
gimp2Plugins.gmic
gimp3Plugins.gimp
gimp3Plugins.gmic
gimp2-with-plugins
gimp3-with-plugins
gimpPlugins.fourier
gimp2Plugins.fourier
gimpPlugins.farbfeld
gimp2Plugins.farbfeld
gimpPlugins.lightning
gimpPlugins.lqrPlugin
gimpPlugins.texturize
gimp2Plugins.lightning
gimp2Plugins.lqrPlugin
gimp2Plugins.texturize
gimp3Plugins.lightning
gimpPlugins.gimplensfun
gimp2Plugins.gimplensfun
gimpPlugins.resynthesizer
gimpPlugins.waveletSharpen
gimp2Plugins.waveletSharpen

          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Gimp: gimp: denial of service via crafted psp image file
          
      https://access.redhat.com/security/cve/CVE-2026-2271
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2438429
    
    x_refsource_REDHATissue-tracking
  
      https://gitlab.gnome.org/GNOME/gimp/-/issues/15732
    
    gimp

    gimp:2.8/gimp

            Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/15732

NIXPKGS-2026-0798

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-27893
          
        8.8 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out
          
      https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59
    
    x_refsource_CONFIRM
  
      https://github.com/vllm-project/vllm/pull/36192
    
    x_refsource_MISC
  
      https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72
    
    x_refsource_MISC
  
    vllm

            ==>= 0.10.1, < 0.18.0
          
            Upstream advisory: https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59

Nixpkgs security tracker

Published issues

etcd: Authorization bypasses in multiple APIs

Squid has Denial of Service in ICP Response handling

Local Incus UI web server vulnerable to nuthentication bypass

Incus vulnerable to denial of source through crafted bucket backup file

Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key

SiYuan has Arbitrary Document Reading within the Publishing Service

S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)

Gimp: gimp: denial of service via crafted psp image file

vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out