NIXPKGS-2026-0685

GitHub issue published 5 months, 4 weeks ago

Permalink CVE-2026-32810

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Halloy has insecure file permissions on credential files

https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g x_refsource_CONFIRM
https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb x_refsource_MISC

halloy

==<= 2026.4

Upstream advisory: https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g
Upstream patch: https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb

NIXPKGS-2026-0680

GitHub issue published 5 months, 4 weeks ago

Permalink CVE-2026-33425

updated 5 months, 4 weeks ago by @mweinelt Activity log

Created suggestion 5 months, 4 weeks ago
@mweinelt accepted 5 months, 4 weeks ago
@mweinelt ignored
6 packages
- discourseAllPlugins
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 4 weeks ago
@mweinelt published on GitHub 5 months, 4 weeks ago

Discourse has inferable private group membership or existence via exclude_groups parameter

https://github.com/discourse/discourse/security/advisories/GHSA-r6rh-xvf5-r5f2 x_refsource_CONFIRM

discourse

=== 2026.3.0-latest
==>= 2026.1.0-latest, < 2026.1.2
==>= 2026.2.0-latest, < 2026.2.1

https://github.com/discourse/discourse/security/advisories/GHSA-r6rh-xvf5-r5f2

NIXPKGS-2026-0679

GitHub issue published 5 months, 4 weeks ago

Permalink CVE-2026-29794

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 5 months, 4 weeks ago by @mweinelt Activity log

Created suggestion 5 months, 4 weeks ago
@mweinelt accepted 5 months, 4 weeks ago
@mweinelt ignored package vikunja-desktop 5 months, 4 weeks ago
@mweinelt published on GitHub 5 months, 4 weeks ago

Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m547-hp4w-j6jx x_refsource_CONFIRM
https://vikunja.io/changelog/vikunja-v2.2.0-was-released x_refsource_MISC

vikunja

==>= 0.8, < 2.2.0

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m547-hp4w-j6jx

NIXPKGS-2026-0677

GitHub issue published 5 months, 4 weeks ago

Permalink CVE-2026-30891

updated 5 months, 4 weeks ago by @mweinelt Activity log

Created suggestion 5 months, 4 weeks ago
@mweinelt accepted 5 months, 4 weeks ago
@mweinelt ignored
6 packages
- discourseAllPlugins
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 4 weeks ago
@mweinelt published on GitHub 5 months, 4 weeks ago

Discourse hasUnauthorized Exposure of Private User Action Types

https://github.com/discourse/discourse/security/advisories/GHSA-ww5f-24g5-c33g x_refsource_CONFIRM

discourse

==>= 2026.2.0-latest, < 2026.2.1
=== 2026.3.0-latest.1
==>= 2026.1.0-latest, < 2026.1.2

https://github.com/discourse/discourse/security/advisories/GHSA-ww5f-24g5-c33g

NIXPKGS-2026-0681

GitHub issue published 5 months, 4 weeks ago

Permalink CVE-2026-33068

updated 5 months, 4 weeks ago by @mweinelt Activity log

Created suggestion 5 months, 4 weeks ago
@mweinelt accepted 5 months, 4 weeks ago
@mweinelt ignored
7 packages
- claude-code-acp
- claude-code-bin
- claude-code-router
- gnomeExtensions.claude-code-usage
- gnomeExtensions.claude-code-switcher
- vscode-extensions.anthropic.claude-code
- gnomeExtensions.claude-code-usage-indicator
5 months, 4 weeks ago
@mweinelt published on GitHub 5 months, 4 weeks ago

Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

https://github.com/anthropics/claude-code/security/advisories/GHSA-mmgp-wc2j-qcv7 x_refsource_CONFIRM

claude-code

==< 2.1.53

Vulnerability remains unfixed on NixOS 25.11

NIXPKGS-2026-0678

GitHub issue published 5 months, 4 weeks ago

Permalink CVE-2026-33422

3.5 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 4 weeks ago by @mweinelt Activity log

Created suggestion 5 months, 4 weeks ago
@mweinelt accepted 5 months, 4 weeks ago
@mweinelt ignored
6 packages
- discourseAllPlugins
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 4 weeks ago
@mweinelt published on GitHub 5 months, 4 weeks ago

Discourse exposes ip_address of flagged user

https://github.com/discourse/discourse/security/advisories/GHSA-x32r-45vg-vm84 x_refsource_CONFIRM

discourse

==>= 2026.2.0-latest, < 2026.2.1
=== 2026.3.0-latest
==>= 2026.1.0-latest, < 2026.1.2

https://github.com/discourse/discourse/security/advisories/GHSA-x32r-45vg-vm84

NIXPKGS-2026-0676

GitHub issue published 6 months ago

          Permalink
          
            CVE-2026-3979
          
        5.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Exploit Code Maturity (E): Proof-of-Concept (P)
        
          Remediation Level (RL): Official Fix (O)
        
          Report Confidence (RC): Confirmed (C)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          6 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months ago
          
          @LeSuisse
          
              ignored
            
                7 packages
                python312Packages.quickjs
python313Packages.quickjs
python314Packages.quickjs
haskellPackages.mquickjs-hs
python312Packages.llm-tools-quickjs
python313Packages.llm-tools-quickjs
python314Packages.llm-tools-quickjs

          6 months ago
          
          @LeSuisse
          
              accepted
            
          6 months ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months ago
          
            quickjs-ng quickjs quickjs.c js_iterator_concat_return use after free
          
      VDB-350414 | quickjs-ng quickjs quickjs.c js_iterator_concat_return use after free
    
    technical-descriptionvdb-entry
  
      VDB-350414 | CTI Indicators (IOB, IOC, IOA)
    
    signaturepermissions-required
  
      Submit #769600 | quickjs-ng QuickJS 0.12.1 Use-After-Free
    
    third-party-advisory
  
      https://github.com/quickjs-ng/quickjs/issues/1368
    
    issue-tracking
  
      https://github.com/quickjs-ng/quickjs/pull/1370
    
    patchissue-tracking
  
      https://github.com/quickjs-ng/quickjs/issues/1368#issue-4004680962
    
    exploitissue-tracking
  
      https://github.com/quickjs-ng/quickjs/commit/daab4ad4bae4ef071ed0294618d6244e92…
    
    patch
  
      https://github.com/quickjs-ng/quickjs/
    
    product
  
    quickjs

            ==0.12.1
          
            ==0.12.0
          
            Upstream issue: https://github.com/quickjs-ng/quickjs/issues/1368
Upstream patch: https://github.com/quickjs-ng/quickjs/commit/daab4ad4bae4ef071ed0294618d6244e92def4cd

NIXPKGS-2026-0675

GitHub issue published 6 months ago

          Permalink
          
            CVE-2026-32230
          
        5.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months ago
          
          @LeSuisse
          
              ignored
            
                7 packages
                python312Packages.uptime-kuma-api
python313Packages.uptime-kuma-api
python314Packages.uptime-kuma-api
gnomeExtensions.uptime-kuma-indicator
python312Packages.uptime-kuma-monitor
python313Packages.uptime-kuma-monitor
python314Packages.uptime-kuma-monitor

          6 months ago
          
          @LeSuisse
          
              deleted
            
              maintainer @JulienMalka
            
          6 months ago
          
              maintainer.delete
            
          @LeSuisse
          
              accepted
            
          6 months ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months ago
          
            Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page
          
      https://github.com/louislam/uptime-kuma/security/advisories/GHSA-c7hf-c5p5-5g6h
    
    x_refsource_CONFIRM
  
      https://github.com/louislam/uptime-kuma/issues/7038
    
    x_refsource_MISC
  
      https://github.com/louislam/uptime-kuma/issues/7135
    
    x_refsource_MISC
  
      https://github.com/louislam/uptime-kuma/commit/303a609c05d0b174a5045c90f53c2b557d4febae
    
    x_refsource_MISC
  
      https://github.com/louislam/uptime-kuma/releases/tag/2.2.0
    
    x_refsource_MISC
  
    uptime-kuma

            ==>= 2.0.0, < 2.2.0
          
            Upstream advisory: https://github.com/louislam/uptime-kuma/security/advisories/GHSA-c7hf-c5p5-5g6h
Upstream patch: https://github.com/louislam/uptime-kuma/commit/303a609c05d0b174a5045c90f53c2b557d4febae

NIXPKGS-2026-0671

GitHub issue published 6 months ago

Permalink CVE-2026-4092

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse ignored package clasp-common-lisp 6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

Arbitrary File Write via Path Traversal in Google clasp leading to RCE

https://github.com/google/clasp/pull/1109

Clasp

==< 3.2.0

Upstream patch: https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3

NIXPKGS-2026-0665

GitHub issue published 6 months ago

Permalink CVE-2026-2922

updated 6 months ago by @LeSuisse Activity log

Created suggestion 6 months ago
@LeSuisse ignored
8 packages
- gst_all_1.gst-vaapi
- gst_all_1.gstreamermm
- ocamlPackages.gstreamer
- ocamlPackages_latest.gstreamer
- obs-studio-plugins.obs-gstreamer
- libsForQt5.phonon-backend-gstreamer
- plasma5Packages.phonon-backend-gstreamer
- tests.pkg-config.defaultPkgConfigPackages."gstreamer-controller-1.0"
6 months ago
@LeSuisse accepted 6 months ago
@LeSuisse published on GitHub 6 months ago

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI-26-165 x_research-advisory
vendor-provided URL vendor-advisory

GStreamer

==1c6e163aa33962f5ee4a87d29319ccdd5cb67612

OSS Sec announcement: https://www.openwall.com/lists/oss-security/2026/03/16/2

Nixpkgs security tracker

Published issues

Halloy has insecure file permissions on credential files

Discourse has inferable private group membership or existence via exclude_groups parameter

Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

Discourse hasUnauthorized Exposure of Private User Action Types

Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File

Discourse exposes ip_address of flagged user

quickjs-ng quickjs quickjs.c js_iterator_concat_return use after free

Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page

Arbitrary File Write via Path Traversal in Google clasp leading to RCE

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability