NIXPKGS-2026-0710

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-33194

6.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vm69-h85x-8p85 x_refsource_CONFIRM

siyuan

==< 3.6.2

Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vm69-h85x-8p85

NIXPKGS-2026-0706

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-32114

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Discourse's unscoped status lookups leak restricted metadata

https://github.com/discourse/discourse/security/advisories/GHSA-3cvr-pm4c-hx96 x_refsource_CONFIRM

discourse

==>= 2026.2.0-latest, < 2026.2.1
=== 2026.3.0-latest
==>= 2026.1.0-latest, < 2026.1.2

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-3cvr-pm4c-hx96

NIXPKGS-2026-0702

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-3547

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

wolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validation

https://github.com/wolfSSL/wolfssl/pull/9859 patch

wolfSSL

<5.9.0

Upstream patch: https://github.com/wolfSSL/wolfssl/commit/9d3cc6e30c778b124002cc45b7974d718b6649fd

NIXPKGS-2026-0698

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-32751
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface
          
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qr46-rcv3-4hq3
    
    x_refsource_CONFIRM
  
      https://github.com/siyuan-note/siyuan/commit/f6d35103f774b65e52f03e018649ff0e57924fb0
    
    x_refsource_MISC
  
      https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1
    
    x_refsource_MISC
  
    siyuan

            ==< 3.6.1
          
            Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qr46-rcv3-4hq3
Upstream patch: https://github.com/siyuan-note/siyuan/commit/f6d35103f774b65e52f03e018649ff0e57924fb0

NIXPKGS-2026-0694

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33150
          
        7.8 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              ignored
            
              package haskellPackages.libfuse3
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Use After Free in libfuse
          
      https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx
    
    x_refsource_CONFIRM
  
      https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836
    
    x_refsource_MISC
  
      https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2
    
    x_refsource_MISC
  
    libfuse

            ==>= 3.18.0, < 3.18.2
          
            Upstream advisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx
Patch: https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836

NIXPKGS-2026-0690

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2025-71276

6.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

SOGo before 5.12.5 is prone to a XSS vulnerability with …

https://github.com/Alinto/sogo/commit/e9b3f2a43d7557e8416f6749df4ab4f9128af2d1

SOGo

<5.12.5

Upstream patch: https://github.com/Alinto/sogo/commit/e9b3f2a43d7557e8416f6749df4ab4f9128af2d1

NIXPKGS-2026-0686

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-32305
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              ignored
            
              package traefik-certs-dumper
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Traefik mTLS bypass via fragmented ClientHello SNI extraction failure
          
      https://github.com/traefik/traefik/security/advisories/GHSA-wvvq-wgcr-9q48
    
    x_refsource_CONFIRM
  
      https://github.com/traefik/traefik/releases/tag/v2.11.41
    
    x_refsource_MISC
  
      https://github.com/traefik/traefik/releases/tag/v3.6.11
    
    x_refsource_MISC
  
      https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2
    
    x_refsource_MISC
  
    traefik

            ==>= 3.7.0-ea.1, < 3.7.0-ea.2
          
            ==>= 3.0.0-beta1, < 3.6.11
          
            ==< 2.11.41
          
            Upstream advisory: https://github.com/traefik/traefik/security/advisories/GHSA-wvvq-wgcr-9q48

NIXPKGS-2026-0682

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-33230
          
        6.1 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            nltk Vulnerable to Cross-site Scripting
          
      https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7
    
    x_refsource_CONFIRM
  
      https://github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f
    
    x_refsource_MISC
  
      https://github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e
    
    x_refsource_MISC
  
    nltk

            ==<= 3.9.3
          
            Upstream advisory: https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7

NIXPKGS-2026-0737

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-30889

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Discourse has Unauthorized Post Data Exposure in discourse-user-notes

https://github.com/discourse/discourse/security/advisories/GHSA-5qm9-r98f-g4mq x_refsource_CONFIRM

discourse

==>= 2026.2.0-latest, < 2026.2.1
=== 2026.3.0-latest.1
==>= 2026.1.0-latest, < 2026.1.2

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-5qm9-r98f-g4mq

NIXPKGS-2026-0729

GitHub issue published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-4541
          
        2.5 LOW
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Exploit Code Maturity (E): Proof-of-Concept (P)
        
          Remediation Level (RL): Official Fix (O)
        
          Report Confidence (RC): Confirmed (C)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification
          
      VDB-352358 | janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification
    
    vdb-entry
  
      VDB-352358 | CTI Indicators (IOB, IOC, IOA)
    
    permissions-requiredsignature
  
      Submit #774687 | GitHub tinyssh 20250501 Cryptographic Issues
    
    third-party-advisory
  
      https://github.com/janmojzis/tinyssh/issues/101
    
    issue-tracking
  
      https://github.com/janmojzis/tinyssh/pull/102
    
    patchissue-tracking
  
      https://github.com/janmojzis/tinyssh/issues/101#issue-3983586116
    
    issue-trackingexploit
  
      https://github.com/janmojzis/tinyssh/commit/9c87269607e0d7d20174df742accc49c042…
    
    patch
  
      https://github.com/janmojzis/tinyssh/releases/tag/20260301
    
    patch
  
      https://github.com/janmojzis/tinyssh/
    
    product
  
    tinyssh

            ==20260301
          
            ==20250501
          
            Issue: https://github.com/janmojzis/tinyssh/issues/101#issue-3983586116
Patch: https://github.com/janmojzis/tinyssh/commit/9c87269607e0d7d20174df742accc49c042cff17

Nixpkgs security tracker

Published issues

SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home

Discourse's unscoped status lookups leak restricted metadata

wolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validation

SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface

Use After Free in libfuse

SOGo before 5.12.5 is prone to a XSS vulnerability with …

Traefik mTLS bypass via fragmented ClientHello SNI extraction failure

nltk Vulnerable to Cross-site Scripting

Discourse has Unauthorized Post Data Exposure in discourse-user-notes

janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification