NIXPKGS-2026-0720

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-31869

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check

https://github.com/discourse/discourse/security/advisories/GHSA-5f9h-vp7v-7vq5 x_refsource_CONFIRM

discourse

==>= 2026.2.0-latest, < 2026.2.1
=== 2026.3.0-latest
==>= 2026.1.0-latest, < 2026.1.2

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-5f9h-vp7v-7vq5

NIXPKGS-2026-0716

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33428

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership

https://github.com/discourse/discourse/security/advisories/GHSA-frcw-p4mc-x6mp x_refsource_CONFIRM

discourse

=== 2026.3.0-latest
==>= 2026.1.0-latest, < 2026.1.2
==>= 2026.2.0-latest, < 2026.2.1

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-frcw-p4mc-x6mp

NIXPKGS-2026-0712

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-32595
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              ignored
            
              package traefik-certs-dumper
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration
          
      https://github.com/traefik/traefik/security/advisories/GHSA-g3hg-j4jv-cwfr
    
    x_refsource_CONFIRM
  
      https://github.com/traefik/traefik/releases/tag/v2.11.41
    
    x_refsource_MISC
  
      https://github.com/traefik/traefik/releases/tag/v3.6.11
    
    x_refsource_MISC
  
      https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2
    
    x_refsource_MISC
  
    traefik

            ==>= 3.0.0-beta1, < 3.6.11
          
            ==>= 3.7.0-ea.1, < 3.7.0-ea.2
          
            ==< 2.11.41
          
            Upstream advisory: https://github.com/traefik/traefik/security/advisories/GHSA-g3hg-j4jv-cwfr

NIXPKGS-2026-0708

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33231

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g x_refsource_CONFIRM
https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b x_refsource_MISC

nltk

==<= 3.9.3

Upstream advisory: https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g
Upstream patch: https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b

NIXPKGS-2026-0704

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-32303
          
        7.6 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              ignored
            
              package cryptomator-cli
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Cryptomator: Tampered vault configuration allows MITM attack on Hub API
          
      https://github.com/cryptomator/cryptomator/security/advisories/GHSA-34rf-rwr3-7g43
    
    x_refsource_CONFIRM
  
      https://github.com/cryptomator/cryptomator/pull/4179
    
    x_refsource_MISC
  
      https://github.com/cryptomator/cryptomator/commit/6b82abcd80449a30b561d823193f9ecea542a625
    
    x_refsource_MISC
  
      https://github.com/cryptomator/cryptomator/releases/tag/1.19.1
    
    x_refsource_MISC
  
    cryptomator

            ==< 1.19.1
          
            Upstream advisory: https://github.com/cryptomator/cryptomator/security/advisories/GHSA-34rf-rwr3-7g43
Upstream patch: https://github.com/cryptomator/cryptomator/commit/6b82abcd80449a30b561d823193f9ecea542a625

NIXPKGS-2026-0700

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-3230

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Improper key_share validation in TLS 1.3 HelloRetryRequest

https://github.com/wolfSSL/wolfssl/pull/9754

wolfSSL

<5.9.0

Upstream patch: https://github.com/wolfSSL/wolfssl/commit/f810dc2a017b0e95f755740cb37c8884345c4de7

NIXPKGS-2026-0696

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-4395

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Heap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path

https://github.com/wolfSSL/wolfssl/pull/9988 patch

wolfssl

=<5.8.4

Upstream patch: https://github.com/wolfSSL/wolfssl/commit/ddc177b669cff9d3c7e1b51751f9df73062b872a

NIXPKGS-2026-0692

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33550

2.0 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

SOGo before 5.12.5 does not renew the OTP if a …

SOGo

<5.12.5

Upstream patch: https://github.com/Alinto/sogo/commit/83d4c522f87cfde0ba543837d9b24c3479083ec2

NIXPKGS-2026-0688

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33236

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7 x_refsource_CONFIRM
https://github.com/nltk/nltk/commit/89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a x_refsource_MISC

nltk

==<= 3.9.3

Upstream advisory: https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7
Upstream patch: https://github.com/nltk/nltk/commit/89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a

NIXPKGS-2026-0684

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33164

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

NULL Pointer Dereference in libde265

https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r x_refsource_CONFIRM
https://github.com/strukturag/libde265/releases/tag/v1.0.17 x_refsource_MISC

libde265

==< 1.0.17

Upstream advisory: https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r

Nixpkgs security tracker

Published issues

Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check

Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership

Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration

NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

Cryptomator: Tampered vault configuration allows MITM attack on Hub API

Improper key_share validation in TLS 1.3 HelloRetryRequest

Heap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path

SOGo before 5.12.5 does not renew the OTP if a …

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

NULL Pointer Dereference in libde265