NIXPKGS-2026-0570

GitHub issue published 6 months, 1 week ago

          Permalink
          
            CVE-2026-30832
          
        9.1 CRITICAL
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 1 week ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            Soft Serve: SSRF via unvalidated LFS endpoint in repo import
          
      https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-3fvx-xrxq-8jvv
    
    x_refsource_CONFIRM
  
      https://github.com/charmbracelet/soft-serve/commit/3ef660098ab37a7950457da8ecc25b516e37ce4e
    
    x_refsource_MISC
  
      https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.4
    
    x_refsource_MISC
  
    soft-serve

            ==>= 0.6.0, < 0.11.4
          
            https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-3fvx-xrxq-8jvv

NixOS Unstable: https://github.com/NixOS/nixpkgs/pull/497054

NIXPKGS-2026-0575

GitHub issue published 6 months, 1 week ago

Permalink CVE-2026-29195

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 1 week ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

Netmaker: Privilege Escalation from Admin to Super-Admin via User Update

https://github.com/gravitl/netmaker/security/advisories/GHSA-ch3w-9456-38v3 x_refsource_CONFIRM
https://github.com/gravitl/netmaker/releases/tag/v1.5.0 x_refsource_MISC

netmaker

==< 1.5.0

Upstream advisory: https://github.com/gravitl/netmaker/security/advisories/GHSA-ch3w-9456-38v3

NIXPKGS-2026-0566

GitHub issue published 6 months, 1 week ago

          Permalink
          
            CVE-2025-15602
          
        8.8 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 1 week ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation
          
      https://github.com/grokability/snipe-it/releases/tag/v8.3.7
    
    patchrelease-notes
  
      https://snipeitapp.com/
    
    product
  
      https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-lea…
    
    third-party-advisory
  
    Snipe-IT

            <8.3.7
          
            NixOS Unstable: https://github.com/NixOS/nixpkgs/commit/ab0b678bb6d6b564079108ff431e6fb01d1b492e
NixOS 25.11: https://github.com/NixOS/nixpkgs/pull/486331 (unmerged)

NIXPKGS-2026-0571

GitHub issue published 6 months, 1 week ago

Permalink CVE-2026-29193

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 1 week ago
@mweinelt ignored package zitadel-tools 6 months, 1 week ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2

https://github.com/zitadel/zitadel/security/advisories/GHSA-25rw-g6ff-fmg8 x_refsource_CONFIRM

zitadel

==>= 4.0.0, < 4.12.1

Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-25rw-g6ff-fmg8

NIXPKGS-2026-0576

GitHub issue published 6 months, 1 week ago

Permalink CVE-2026-30838

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 1 week ago
@mweinelt ignored
33 packages
- rubyPackages_4_0.jekyll-commonmark-ghpages
- rubyPackages_3_4.jekyll-commonmark-ghpages
- rubyPackages_3_3.jekyll-commonmark-ghpages
- guile-commonmark
- rubyPackages.commonmarker
- haskellPackages.commonmark
- python312Packages.commonmark
- python313Packages.commonmark
- python314Packages.commonmark
- rubyPackages_3_1.commonmarker
- rubyPackages_3_2.commonmarker
- rubyPackages_3_3.commonmarker
- rubyPackages_3_4.commonmarker
- rubyPackages_4_0.commonmarker
- haskellPackages.commonmark-cli
- python312Packages.recommonmark
- python313Packages.recommonmark
- python314Packages.recommonmark
- rubyPackages.jekyll-commonmark
- tests.nixosOptionsDoc.commonMark
- haskellPackages.commonmark-pandoc
- haskellPackages.commonmark-simple
- haskellPackages.commonmark-initial
- rubyPackages_3_1.jekyll-commonmark
- rubyPackages_3_2.jekyll-commonmark
- rubyPackages_3_3.jekyll-commonmark
- rubyPackages_3_4.jekyll-commonmark
- rubyPackages_4_0.jekyll-commonmark
- haskellPackages.commonmark-wikilink
- haskellPackages.commonmark-extensions
- rubyPackages.jekyll-commonmark-ghpages
- rubyPackages_3_1.jekyll-commonmark-ghpages
- rubyPackages_3_2.jekyll-commonmark-ghpages
6 months, 1 week ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names

https://github.com/thephpleague/commonmark/security/advisories/GHSA-4v6x-c7xx-hw9f x_refsource_CONFIRM

commonmark

==< 2.8.1

Affects flarum per composer.lock file
@jasondoom @fsagbuya

NIXPKGS-2026-0580

GitHub issue published 6 months, 1 week ago

Permalink CVE-2026-29192

7.7 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 1 week ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover

https://github.com/zitadel/zitadel/security/advisories/GHSA-6rx5-m2rc-hmf7 x_refsource_CONFIRM

zitadel

==>= 4.0.0, < 4.12.0

Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-6rx5-m2rc-hmf7

NIXPKGS-2026-0573

GitHub issue published 6 months, 1 week ago

Permalink CVE-2026-29194

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 1 week ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

Netmaker: Insufficient Authorization in Host Token Verification

https://github.com/gravitl/netmaker/security/advisories/GHSA-hmqr-wjmj-376c x_refsource_CONFIRM
https://github.com/gravitl/netmaker/releases/tag/v1.5.0 x_refsource_MISC

netmaker

==< 1.5.0

Upstream advisory: https://github.com/gravitl/netmaker/security/advisories/GHSA-hmqr-wjmj-376c

NIXPKGS-2026-0568

GitHub issue published 6 months, 1 week ago

Permalink CVE-2026-30830

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 1 week ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag

https://github.com/kepano/defuddle/security/advisories/GHSA-5mq8-78gm-pjmq x_refsource_CONFIRM
https://github.com/kepano/defuddle/commit/f154cb740ee603431b69638273af737a27156df9 x_refsource_MISC

defuddle

==< 0.9.0

Upstream advisory: https://github.com/kepano/defuddle/security/advisories/GHSA-5mq8-78gm-pjmq

NIXPKGS-2026-0574

GitHub issue published 6 months, 1 week ago

Permalink CVE-2026-29067

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 1 week ago
@mweinelt ignored package zitadel-tools 6 months, 1 week ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login

https://github.com/zitadel/zitadel/security/advisories/GHSA-pfrf-9r5f-73f5 x_refsource_CONFIRM

zitadel

==>= 4.0.0-rc.1, < 4.7.1

Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-pfrf-9r5f-73f5

NIXPKGS-2026-0569

GitHub issue published 6 months, 1 week ago

Permalink CVE-2026-29191

9.3 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 1 week ago
@mweinelt ignored package zitadel-tools 6 months, 1 week ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint

https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq x_refsource_CONFIRM

zitadel

==>= 4.0.0, < 4.12.0

Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-pr34-2v5x-6qjq

Nixpkgs security tracker

Published issues

Soft Serve: SSRF via unvalidated LFS endpoint in repo import

Netmaker: Privilege Escalation from Admin to Super-Admin via User Update

Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation

ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2

league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names

ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover

Netmaker: Insufficient Authorization in Host Token Verification

Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag

ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login

ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint