NIXPKGS-2026-0032

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2026-23528

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
16 packages
- github-distributed-owners
- haskellPackages.distributed-fork
- haskellPackages.aivika-distributed
- haskellPackages.distributed-static
- haskellPackages.distributed-closure
- haskellPackages.distributed-process
- haskellPackages.powerqueue-distributed
- haskellPackages.distributed-process-ekg
- haskellPackages.distributed-process-async
- haskellPackages.distributed-process-tests
- haskellPackages.distributed-process-extras
- haskellPackages.distributed-process-systest
- haskellPackages.distributed-process-execution
- haskellPackages.distributed-process-supervisor
- haskellPackages.distributed-process-client-server
- haskellPackages.distributed-process-monad-control
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Dask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard

https://github.com/dask/distributed/security/advisories/GHSA-c336-7962-wfj2 x_refsource_CONFIRM
https://github.com/dask/distributed/commit/ab72092a8a938923c2bb51a2cd14ca26614827fa x_refsource_MISC

distributed

==< 2026.1.0

Upstream advisory: https://github.com/dask/distributed/security/advisories/GHSA-c336-7962-wfj2
Upstream fix: https://github.com/dask/distributed/commit/ab72092a8a938923c2bb51a2cd14ca26614827fa

NIXPKGS-2026-0030

published 5 months, 3 weeks ago

          Permalink
          
            CVE-2025-62395
          
        4.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          7 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              package moodle-dl
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              deleted
            
              maintainer @freezeboy
            
          5 months, 3 weeks ago
          
              maintainer.delete
            
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Moodle: external cohort search service leaks system cohort data
          
      https://access.redhat.com/security/cve/CVE-2025-62395
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2404428
    
    issue-trackingx_refsource_REDHAT
  
    moodle

            <4.5.7
          
            <5.0.3
          
            <4.4.11
          
            <4.1.21

NIXPKGS-2026-0033

GitHub issue published 5 months, 3 weeks ago

Permalink CVE-2025-68675

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Apache Airflow: proxy credentials for various providers might leak in task logs

apache-airflow

<3.1.6

Upstream advisory: https://lists.apache.org/thread/x6kply4nqd4vc4wgxtm6g9r2tt63s8c5

NIXPKGS-2026-0020

published 5 months, 3 weeks ago

Permalink CVE-2026-22852

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

FreeRDP has a heap-buffer-overflow in audin_process_formats

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9chc-g79v-4qq4 x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 x_refsource_MISC

FreeRDP

==< 3.20.1

Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9chc-g79v-4qq4

NIXPKGS-2026-0019

published 5 months, 3 weeks ago

Permalink CVE-2026-22856

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

FreeRDP has a heap-use-after-free in create_irp_thread

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w842-c386-fxhv x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 x_refsource_MISC

FreeRDP

==< 3.20.1

Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w842-c386-fxhv

NIXPKGS-2026-0018

published 5 months, 3 weeks ago

Permalink CVE-2026-22863

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
12 packages
- speech-denoiser
- openimagedenoise
- terraform-providers.deno
- python312Packages.denonavr
- python313Packages.denonavr
- haskellPackages.pandoc-sidenote
- terraform-providers.denoland_deno
- gnomeExtensions.denon-avr-controler
- python312Packages.bnunicodenormalizer
- python313Packages.bnunicodenormalizer
- vscode-extensions.denoland.vscode-deno
- home-assistant-component-tests.denonavr
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Deno node:crypto doesn't finalize cipher

https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v x_refsource_CONFIRM
https://github.com/denoland/deno/releases/tag/v2.6.0 x_refsource_MISC

deno

==< 2.6.0

Upstream advisory: https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v

NIXPKGS-2026-0017

published 5 months, 3 weeks ago

Permalink CVE-2026-22816

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse ignored
6 packages
- gradle-dependency-tree-diff
- vscode-extensions.vscjava.vscode-gradle
- gradle_9-unwrapped
- gradle_8-unwrapped
- gradle_7-unwrapped
- gradle-completion
5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Gradle fails to disable repositories which can expose builds to malicious artifacts

https://github.com/gradle/gradle/security/advisories/GHSA-w78c-w6vf-rw82 x_refsource_CONFIRM
https://github.com/gradle/gradle/commit/e5707d0d8fce3d768c9c489004700d78eab1773a x_refsource_MISC

gradle

==< 9.3.0

Upstream advisory: https://github.com/gradle/gradle/security/advisories/GHSA-w78c-w6vf-rw82

NIXPKGS-2026-0027

published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-23535
          
        8.0 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                3 packages
                wlcs
wlclock
imewlconverter

          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            wlc Path traversal: Unsanitized API slugs in download command
          
      https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg
    
    x_refsource_CONFIRM
  
      https://github.com/WeblateOrg/wlc/pull/1128
    
    x_refsource_MISC
  
      https://github.com/WeblateOrg/wlc/commit/216e691c6e50abae97fe2e4e4f21501bf49a585f
    
    x_refsource_MISC
  
      https://github.com/WeblateOrg/wlc/releases/tag/1.17.2
    
    x_refsource_MISC
  
    wlc

            ==< 1.17.2
          
          Upstream advisory: https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg
Upstream patch: https://github.com/WeblateOrg/wlc/commit/216e691c6e50abae97fe2e4e4f21501bf49a585f

NIXPKGS-2026-0023

published 5 months, 3 weeks ago

Permalink CVE-2026-22857

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 3 weeks ago
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

FreeRDP has a heap-use-after-free in irp_thread_func

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gxq-jhq6-4cr8 x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 x_refsource_MISC

FreeRDP

==< 3.20.1

Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gxq-jhq6-4cr8

NIXPKGS-2026-0025

published 5 months, 3 weeks ago

          Permalink
          
            CVE-2026-23645
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload
          
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pcjq-j3mq-jv5j
    
    x_refsource_CONFIRM
  
      https://github.com/siyuan-note/siyuan/issues/16844
    
    x_refsource_MISC
  
      https://github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388
    
    x_refsource_MISC
  
    siyuan

            ==< 3.5.4-dev2
          
          Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pcjq-j3mq-jv5j
Upstream patch: https://github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388

Nixpkgs security tracker

Published issues

Dask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard

Moodle: external cohort search service leaks system cohort data

Apache Airflow: proxy credentials for various providers might leak in task logs

FreeRDP has a heap-buffer-overflow in audin_process_formats

FreeRDP has a heap-use-after-free in create_irp_thread

Deno node:crypto doesn't finalize cipher

Gradle fails to disable repositories which can expose builds to malicious artifacts

wlc Path traversal: Unsanitized API slugs in download command

FreeRDP has a heap-use-after-free in irp_thread_func

SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload