NIXPKGS-2026-0766

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-29785
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            NATS Server panic via malicious compression on leafnode port
          
      https://github.com/nats-io/nats-server/security/advisories/GHSA-52jh-2xxh-pwh6
    
    x_refsource_CONFIRM
  
      https://github.com/nats-io/nats-server/commit/a1488de6f2ba6e666aef0f9cce0016f7f167d6a8
    
    x_refsource_MISC
  
      https://advisories.nats.io/CVE/secnote-2026-04.txt
    
    x_refsource_MISC
  
    nats-server

            ==< 2.11.14
          
            ==>= 2.12.0-RC.1, < 2.12.5
          
            Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-52jh-2xxh-pwh6

NIXPKGS-2026-0768

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33216
          
        8.6 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            NATS has MQTT plaintext password disclosure
          
      https://github.com/nats-io/nats-server/security/advisories/GHSA-v722-jcv5-w7mc
    
    x_refsource_CONFIRM
  
      https://github.com/nats-io/nats-server/commit/b5b63cfc35a57075e09c1f57503d31721bed8099
    
    x_refsource_MISC
  
      https://advisories.nats.io/CVE/secnote-2026-05.txt
    
    x_refsource_MISC
  
    nats-server

            ==>= 2.12.0-RC.1, < 2.12.6
          
            ==< 2.11.15
          
            Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-v722-jcv5-w7mc

NIXPKGS-2026-0767

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33247

7.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

NATS credentials are exposed in monitoring port via command-line argv

https://github.com/nats-io/nats-server/security/advisories/GHSA-x6g4-f6q3-fqvv x_refsource_CONFIRM
https://advisories.nats.io/CVE/secnote-2026-14.txt x_refsource_MISC

nats-server

==>= 2.12.0-RC.1, < 2.12.6
==< 2.11.15

Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-x6g4-f6q3-fqvv

NIXPKGS-2026-0738

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33169
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                rubyPackages.yard-activesupport-concern
rubyPackages_3_3.yard-activesupport-concern
rubyPackages_3_4.yard-activesupport-concern
rubyPackages_4_0.yard-activesupport-concern

          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
          
      https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activesupport

            ==< 7.2.3.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==>= 8.1.0.beta1, < 8.1.2.1
          
            Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38

NIXPKGS-2026-0741

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33195
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Rails Active Storage has possible Path Traversal in DiskService
          
      https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activestorage

            ==< 7.2.3.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==>= 8.1.0.beta1, < 8.1.2.1
          
            Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87

NIXPKGS-2026-0740

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-1940
          
        5.1 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                8 packages
                gst_all_1.gstreamermm
gst_all_1.gst-vaapi
ocamlPackages_latest.gstreamer
ocamlPackages.gstreamer
libsForQt5.phonon-backend-gstreamer
obs-studio-plugins.obs-gstreamer
plasma5Packages.phonon-backend-gstreamer
tests.pkg-config.defaultPkgConfigPackages."gstreamer-controller-1.0"

          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Gstreamer: incomplete fix of cve-2026-1940
          
      https://access.redhat.com/security/cve/CVE-2026-1940
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2436932
    
    x_refsource_REDHATissue-tracking
  
      https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4854
    
      https://gstreamer.freedesktop.org/security/sa-2026-0001.html
    
      https://security-tracker.debian.org/tracker/CVE-2026-1940
    
    gstreamer

    gstreamer1

    mingw-gstreamer1

            Advisory: https://gstreamer.freedesktop.org/security/sa-2026-0001.html

NIXPKGS-2026-0742

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33173
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Rails Active Storage has possible content type bypass via metadata in direct uploads
          
      https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activestorage

            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==< 7.2.3.1
          
            ==>= 8.1.0.beta1, < 8.1.2.1
          
            Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg

NIXPKGS-2026-0745

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33174
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
          
      https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activestorage

            ==< 7.2.3.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==>= 8.1.0.beta1, < 8.1.2.1
          
            Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg

NIXPKGS-2026-0739

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33202
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Rails Active Storage has possible glob injection in its DiskService
          
      https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activestorage

            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==< 7.2.3.1
          
            ==>= 8.1.0.beta1, < 8.1.2.1
          
            Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m

NIXPKGS-2026-0746

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33176
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                4 packages
                rubyPackages.yard-activesupport-concern
rubyPackages_3_3.yard-activesupport-concern
rubyPackages_3_4.yard-activesupport-concern
rubyPackages_4_0.yard-activesupport-concern

          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Rails Active Support has a possible DoS vulnerability in its number helpers
          
      https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
    
    x_refsource_CONFIRM
  
      https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a
    
    x_refsource_MISC
  
      https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v7.2.3.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.0.4.1
    
    x_refsource_MISC
  
      https://github.com/rails/rails/releases/tag/v8.1.2.1
    
    x_refsource_MISC
  
    activesupport

            ==< 7.2.3.1
          
            ==>= 8.0.0.beta1, < 8.0.4.1
          
            ==>= 8.1.0.beta1, < 8.1.2.1
          
            Upstream advisory: https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9

Nixpkgs security tracker

Published issues

NATS Server panic via malicious compression on leafnode port

NATS has MQTT plaintext password disclosure

NATS credentials are exposed in monitoring port via command-line argv

Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Rails Active Storage has possible Path Traversal in DiskService

Gstreamer: incomplete fix of cve-2026-1940

Rails Active Storage has possible content type bypass via metadata in direct uploads

Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Rails Active Storage has possible glob injection in its DiskService

Rails Active Support has a possible DoS vulnerability in its number helpers