NIXPKGS-2026-0709

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-32711
          
        7.8 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            pydicom: Path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root
          
      https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28
    
    x_refsource_CONFIRM
  
      https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82
    
    x_refsource_MISC
  
      https://github.com/pydicom/pydicom/releases/tag/v3.0.2
    
    x_refsource_MISC
  
    pydicom

            ==>= 2.0.0-rc.1, < 3.0.2
          
            Upstream advisory: https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28
Upstream patch: https://github.com/pydicom/pydicom/commit/6414f01a053dff925578799f5a7208d2ae585e82

NIXPKGS-2026-0717

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-32733

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Halloy has a file transfer path traveral vulnerability

https://github.com/squidowl/halloy/security/advisories/GHSA-fqrv-rfg4-rv89 x_refsource_CONFIRM
https://github.com/squidowl/halloy/commit/0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6 x_refsource_MISC

halloy

==<= 2026.4

Upstream advisory: https://github.com/squidowl/halloy/security/advisories/GHSA-fqrv-rfg4-rv89
Upstream patch: https://github.com/squidowl/halloy/commit/0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6

NIXPKGS-2026-0735

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33165
          
        5.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            heap out-of-bounds write in libde265 1.0.16
          
      https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg
    
    x_refsource_CONFIRM
  
      https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658
    
    x_refsource_MISC
  
      https://github.com/strukturag/libde265/releases/tag/v1.0.17
    
    x_refsource_MISC
  
    libde265

            ==< 1.0.17
          
            Upstream advisory: https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg
Upstream patch: https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658

NIXPKGS-2026-0731

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-30888

2.2 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Discourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint

https://github.com/discourse/discourse/security/advisories/GHSA-jj9p-p7m6-jq96 x_refsource_CONFIRM

discourse

==< 2026.3.0-latest.1
==>= 2026.1.0-latest, < 2026.1.2
==>= 2026.2.0-latest, < 2026.2.1

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-jj9p-p7m6-jq96

NIXPKGS-2026-0727

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33155

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT

https://github.com/qlustered/deepdiff/security/advisories/GHSA-54jj-px8x-5w5q x_refsource_CONFIRM
https://github.com/qlustered/deepdiff/commit/0d07ec21d12b46ef4e489383b363eadc22d990fb x_refsource_MISC

deepdiff

==>= 5.0.0, < 8.6.2

Upstream advisory: https://github.com/qlustered/deepdiff/security/advisories/GHSA-54jj-px8x-5w5q
Upstream patch: https://github.com/qlustered/deepdiff/commit/0d07ec21d12b46ef4e489383b363eadc22d990fb

NIXPKGS-2026-0723

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33132
          
        5.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              ignored
            
              package zitadel-tools
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            ZITADEL is missing enforcement of organization scopes
          
      https://github.com/zitadel/zitadel/security/advisories/GHSA-g2pf-ww5m-2r9m
    
    x_refsource_CONFIRM
  
      https://github.com/zitadel/zitadel/commit/d90285929ca019fa817f31551fd0883429dda2a8
    
    x_refsource_MISC
  
      https://github.com/zitadel/zitadel/releases/tag/v3.4.9
    
    x_refsource_MISC
  
      https://github.com/zitadel/zitadel/releases/tag/v4.12.3
    
    x_refsource_MISC
  
    zitadel

            ==>= 3.0.0-rc.1, < 3.4.9
          
            ==>= 4.0.0-rc.1, < 4.12.3
          
            ==< 1.80.0-v2.20.0.20260317120401-d90285929ca0
          
            Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-g2pf-ww5m-2r9m
Upstream patch: https://github.com/zitadel/zitadel/commit/d90285929ca019fa817f31551fd0883429dda2a8

NIXPKGS-2026-0719

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33424

5.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Adjacent (A)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Adjacent (A)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

PM access granted through invites after access revocation

https://github.com/discourse/discourse/security/advisories/GHSA-hgcp-p7hq-cwxw x_refsource_CONFIRM

discourse

==>= 2026.2.0-latest, < 2026.2.1
=== 2026.3.0-latest
==>= 2026.1.0-latest, < 2026.1.2

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-hgcp-p7hq-cwxw

NIXPKGS-2026-0715

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-32811
          
        8.2 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              ignored
            
                2 packages
                heimdall
heimdall-gui

          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Heimdall: Path received via Envoy gRPC corrupted when containing query string
          
      https://github.com/dadrus/heimdall/security/advisories/GHSA-r8x2-fhmf-6mxp
    
    x_refsource_CONFIRM
  
      https://github.com/dadrus/heimdall/pull/3106
    
    x_refsource_MISC
  
      https://github.com/dadrus/heimdall/commit/50321b3007db1ccafdc6b1cfd6bdc3689c19a502
    
    x_refsource_MISC
  
      https://github.com/envoyproxy/envoy/blob/105b4acd422d67fcff908ec38d91c7676d079939/api/envoy/service/auth/v3/attribute_context.proto#L146-L147
    
    x_refsource_MISC
  
    heimdall

            ==>= 0.7.0-alpha, < 0.17.11
          
            Upstream advisory: https://github.com/dadrus/heimdall/security/advisories/GHSA-r8x2-fhmf-6mxp

NIXPKGS-2026-0711

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33154
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
          
      https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p
    
    x_refsource_CONFIRM
  
      https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7
    
    x_refsource_MISC
  
      https://github.com/dynaconf/dynaconf/releases/tag/3.2.13
    
    x_refsource_MISC
  
    dynaconf

            ==< 3.2.13
          
            Upstream advisory: https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p
Upstream patch: https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7

NIXPKGS-2026-0707

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33124

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse ignored package home-assistant-custom-components.frigate 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Frigate has insecure password change functionality

https://github.com/blakeblackshear/frigate/security/advisories/GHSA-24p8-r573-vwr2 x_refsource_CONFIRM
https://github.com/blakeblackshear/frigate/commit/152e58520614610988bff3b6ff55d0aefd89c1b2 x_refsource_MISC

frigate

==< 0.17.0-beta1

Upstream advisory: https://github.com/blakeblackshear/frigate/security/advisories/GHSA-24p8-r573-vwr2
Upstream patch: https://github.com/blakeblackshear/frigate/commit/152e58520614610988bff3b6ff55d0aefd89c1b2

Nixpkgs security tracker

Published issues

pydicom: Path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root

Halloy has a file transfer path traveral vulnerability

heap out-of-bounds write in libde265 1.0.16

Discourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint

DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT

ZITADEL is missing enforcement of organization scopes

PM access granted through invites after access revocation

Heimdall: Path received via Envoy gRPC corrupted when containing query string

dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

Frigate has insecure password change functionality