NIXPKGS-2026-0030

published 4 months, 3 weeks ago

          Permalink
          
            CVE-2025-62395
          
        4.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          4 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              package moodle-dl
            
          4 months, 3 weeks ago
          
          @LeSuisse
          
              deleted
            
              maintainer @freezeboy
            
          4 months, 3 weeks ago
          
              maintainer.delete
            
          @LeSuisse
          
              accepted
            
          4 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months, 3 weeks ago
          
            Moodle: external cohort search service leaks system cohort data
          
      https://access.redhat.com/security/cve/CVE-2025-62395
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2404428
    
    issue-trackingx_refsource_REDHAT
  
    moodle

            <4.5.7
          
            <5.0.3
          
            <4.4.11
          
            <4.1.21

NIXPKGS-2026-0025

published 4 months, 3 weeks ago

          Permalink
          
            CVE-2026-23645
          
              updated
            
          4 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          4 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months, 3 weeks ago
          
            SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload
          
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pcjq-j3mq-jv5j
    
    x_refsource_CONFIRM
  
      https://github.com/siyuan-note/siyuan/issues/16844
    
    x_refsource_MISC
  
      https://github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388
    
    x_refsource_MISC
  
    siyuan

            ==< 3.5.4-dev2
          
          Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pcjq-j3mq-jv5j
Upstream patch: https://github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388

NIXPKGS-2026-0019

published 4 months, 3 weeks ago

Permalink CVE-2026-22856

updated 4 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 4 months, 3 weeks ago
@LeSuisse accepted 4 months, 3 weeks ago
@LeSuisse published on GitHub 4 months, 3 weeks ago

FreeRDP has a heap-use-after-free in create_irp_thread

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w842-c386-fxhv x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 x_refsource_MISC

FreeRDP

==< 3.20.1

Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w842-c386-fxhv

NIXPKGS-2026-0018

published 4 months, 3 weeks ago

Permalink CVE-2026-22863

updated 4 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 4 months, 3 weeks ago
@LeSuisse ignored
12 packages
- speech-denoiser
- openimagedenoise
- terraform-providers.deno
- python312Packages.denonavr
- python313Packages.denonavr
- haskellPackages.pandoc-sidenote
- terraform-providers.denoland_deno
- gnomeExtensions.denon-avr-controler
- python312Packages.bnunicodenormalizer
- python313Packages.bnunicodenormalizer
- vscode-extensions.denoland.vscode-deno
- home-assistant-component-tests.denonavr
4 months, 3 weeks ago
@LeSuisse accepted 4 months, 3 weeks ago
@LeSuisse published on GitHub 4 months, 3 weeks ago

Deno node:crypto doesn't finalize cipher

https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v x_refsource_CONFIRM
https://github.com/denoland/deno/releases/tag/v2.6.0 x_refsource_MISC

deno

==< 2.6.0

Upstream advisory: https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v

NIXPKGS-2026-0017

published 4 months, 3 weeks ago

Permalink CVE-2026-22816

updated 4 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 4 months, 3 weeks ago
@LeSuisse ignored
6 packages
- gradle-dependency-tree-diff
- vscode-extensions.vscjava.vscode-gradle
- gradle_9-unwrapped
- gradle_8-unwrapped
- gradle_7-unwrapped
- gradle-completion
4 months, 3 weeks ago
@LeSuisse accepted 4 months, 3 weeks ago
@LeSuisse published on GitHub 4 months, 3 weeks ago

Gradle fails to disable repositories which can expose builds to malicious artifacts

https://github.com/gradle/gradle/security/advisories/GHSA-w78c-w6vf-rw82 x_refsource_CONFIRM
https://github.com/gradle/gradle/commit/e5707d0d8fce3d768c9c489004700d78eab1773a x_refsource_MISC

gradle

==< 9.3.0

Upstream advisory: https://github.com/gradle/gradle/security/advisories/GHSA-w78c-w6vf-rw82

NIXPKGS-2026-0027

published 4 months, 3 weeks ago

          Permalink
          
            CVE-2026-23535
          
        8.0 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          4 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                3 packages
                wlcs
wlclock
imewlconverter

          4 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          4 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months, 3 weeks ago
          
            wlc Path traversal: Unsanitized API slugs in download command
          
      https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg
    
    x_refsource_CONFIRM
  
      https://github.com/WeblateOrg/wlc/pull/1128
    
    x_refsource_MISC
  
      https://github.com/WeblateOrg/wlc/commit/216e691c6e50abae97fe2e4e4f21501bf49a585f
    
    x_refsource_MISC
  
      https://github.com/WeblateOrg/wlc/releases/tag/1.17.2
    
    x_refsource_MISC
  
    wlc

            ==< 1.17.2
          
          Upstream advisory: https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg
Upstream patch: https://github.com/WeblateOrg/wlc/commit/216e691c6e50abae97fe2e4e4f21501bf49a585f

NIXPKGS-2026-0023

published 4 months, 3 weeks ago

Permalink CVE-2026-22857

updated 4 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 4 months, 3 weeks ago
@LeSuisse accepted 4 months, 3 weeks ago
@LeSuisse published on GitHub 4 months, 3 weeks ago

FreeRDP has a heap-use-after-free in irp_thread_func

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gxq-jhq6-4cr8 x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 x_refsource_MISC

FreeRDP

==< 3.20.1

Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gxq-jhq6-4cr8

NIXPKGS-2026-0022

published 4 months, 3 weeks ago

Permalink CVE-2026-22853

updated 4 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 4 months, 3 weeks ago
@LeSuisse accepted 4 months, 3 weeks ago
@LeSuisse published on GitHub 4 months, 3 weeks ago

FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47v9-p4gp-w5ch x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 x_refsource_MISC

FreeRDP

==< 3.20.1

Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47v9-p4gp-w5ch

NIXPKGS-2026-0021

published 4 months, 3 weeks ago

          Permalink
          
            CVE-2026-23490
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          4 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                python312Packages.pysnmp-pyasn1
python313Packages.pysnmp-pyasn1
python312Packages.pyasn1-modules
python313Packages.pyasn1-modules

          4 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          4 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months, 3 weeks ago
          
            pyasn1 has a DoS vulnerability in decoder
          
      https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq
    
    x_refsource_CONFIRM
  
      https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970
    
    x_refsource_MISC
  
      https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2
    
    x_refsource_MISC
  
      https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html
    
    pyasn1

            ==< 0.6.2
          
          Upstream advisory: https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq
Upstream fix: https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970

NIXPKGS-2026-0020

published 4 months, 3 weeks ago

Permalink CVE-2026-22852

updated 4 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 4 months, 3 weeks ago
@LeSuisse accepted 4 months, 3 weeks ago
@LeSuisse published on GitHub 4 months, 3 weeks ago

FreeRDP has a heap-buffer-overflow in audin_process_formats

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9chc-g79v-4qq4 x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 x_refsource_MISC

FreeRDP

==< 3.20.1

Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9chc-g79v-4qq4

Nixpkgs security tracker

Published issues

Moodle: external cohort search service leaks system cohort data

SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload

FreeRDP has a heap-use-after-free in create_irp_thread

Deno node:crypto doesn't finalize cipher

Gradle fails to disable repositories which can expose builds to malicious artifacts

wlc Path traversal: Unsanitized API slugs in download command

FreeRDP has a heap-use-after-free in irp_thread_func

FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array

pyasn1 has a DoS vulnerability in decoder

FreeRDP has a heap-buffer-overflow in audin_process_formats