NIXPKGS-2026-0005

published 5 months, 4 weeks ago

          Permalink
          
            CVE-2025-34458
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            wb2osz/direwolf <= 1.8 Reachable Assertion DoS
          
      https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-010…
    
    exploittechnical-description
  
      https://github.com/wb2osz/direwolf/issues/618
    
    issue-tracking
  
      https://github.com/wb2osz/direwolf/commit/3658a87
    
    patch
  
      https://www.vulncheck.com/advisories/wb2osz-direwolf-reachable-assertion-dos
    
    third-party-advisory
  
    direwolf

            =<1.8
          
            ==commit 3658a87
          
            =<1.8.1
          
          Patch: https://github.com/wb2osz/direwolf/commit/3658a878920803bbb69a4567579dcc4d6cb80a92

NIXPKGS-2026-0004

published 5 months, 4 weeks ago

          Permalink
          
            CVE-2025-69194
          
        8.8 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              deleted
            
              maintainer @SuperSandro2000
            
          5 months, 4 weeks ago
          
              maintainer.delete
            
          @LeSuisse
          
              accepted
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Wget2: arbitrary file write via metalink path traversal in gnu wget2
          
      https://access.redhat.com/security/cve/CVE-2025-69194
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2425773
    
    issue-trackingx_refsource_REDHAT
  
    wget2

            =<2.2.0
          
            ==2.2.1

NIXPKGS-2026-0008

published 5 months, 4 weeks ago

Permalink CVE-2025-14881

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse ignored package pretix-banktool 5 months, 4 weeks ago
@LeSuisse deleted maintainer @mweinelt 5 months, 3 weeks ago maintainer.delete
@LeSuisse accepted 5 months, 3 weeks ago
@LeSuisse published on GitHub 5 months, 3 weeks ago

Insecure direct object reference

https://pretix.eu/about/en/blog/20251218-release-2025-10-1/ vendor-advisory

pretix

<2025.9.0
<2025.10.0
<2025.8.0
<2025.11.0

https://github.com/NixOS/nixpkgs/pull/472420 (Unstable)
https://github.com/NixOS/nixpkgs/pull/472424 (25.11)

NIXPKGS-2026-0002

published 5 months, 4 weeks ago

          Permalink
          
            CVE-2025-34457
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            wb2osz/direwolf <= 1.8 Stack-based Buffer Overflow DoS
          
      https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-010…
    
    exploittechnical-description
  
      https://github.com/wb2osz/direwolf/issues/617
    
    issue-tracking
  
      https://github.com/wb2osz/direwolf/commit/694c954
    
    patch
  
      https://www.vulncheck.com/advisories/wb2osz-direwolf-stack-based-buffer-overflo…
    
    third-party-advisory
  
    direwolf

            =<1.8
          
            =<1.8.1
          
            ==commit 694c954
          
          Patch: https://github.com/wb2osz/direwolf/commit/694c95485b21c1c22bc4682703771dec4d7a374b

NIXPKGS-2026-0001

published 5 months, 4 weeks ago

          Permalink
          
            CVE-2025-34449
          
              updated
            
          5 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              ignored
            
              package qtscrcpy
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              accepted
            
          5 months, 4 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          5 months, 3 weeks ago
          
            Genymobile/scrcpy <= 3.3.3 Global Buffer Overflow
          
      https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-003…
    
    exploittechnical-description
  
      https://github.com/Genymobile/scrcpy/issues/6415
    
    issue-tracking
  
      https://github.com/Genymobile/scrcpy/commit/3e40b24
    
    patch
  
      https://www.vulncheck.com/advisories/genymobile-scrcpy-global-buffer-overflow
    
    third-party-advisory
  
    scrcpy

            =<3.3.3
          
            ==commit 3e40b24
          
          Patch: https://github.com/Genymobile/scrcpy/commit/3e40b2473772cea3a23d4932088fd0bc4cc0f52c

Fixed in 3.3.4 https://github.com/Genymobile/scrcpy/releases/tag/v3.3.4

NIXPKGS-2026-0007

published 5 months, 4 weeks ago

Permalink CVE-2025-13742

updated 5 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored package pretix-banktool 5 months, 4 weeks ago
@mweinelt accepted 5 months, 4 weeks ago
@LeSuisse deleted maintainer @mweinelt 5 months, 3 weeks ago maintainer.delete
@LeSuisse published on GitHub 5 months, 3 weeks ago

Limited HTML injection in emails

https://pretix.eu/about/en/blog/20251126-release-2025-9-1/ vendor-advisory

pretix

<2025.9.0
<2025.7.0
<2025.10.0
<2025.8.0

fbad460b426553178200c2c13d3c3ffef3db61dd (unstable)
d367441a2a542b46bcd8966f654045b7054f5d39 (25.11)
95c90c7122daae516db39fffda5bb4e13dd9161e (25.05)

NIXPKGS-2025-0023

published 6 months, 1 week ago

Permalink CVE-2025-11683

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Adjacent (A)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Adjacent (A)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @LeSuisse Activity log

Created suggestion 7 months, 2 weeks ago
@LeSuisse accepted 6 months, 1 week ago
@LeSuisse published on GitHub 6 months, 1 week ago

YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure

https://github.com/cpan-authors/YAML-Syck/pull/65 patch
https://metacpan.org/dist/YAML-Syck/changes release-notes

YAML-Syck

<1.36

NIXPKGS-2025-0015

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2025-8396

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 9 months, 2 weeks ago
@LeSuisse ignored
14 packages
- temporal-cli
- python312Packages.temporalio
- python313Packages.temporalio
- haskellPackages.temporal-media
- terraform-providers.temporalcloud
- postgresqlPackages.temporal_tables
- postgresql13Packages.temporal_tables
- postgresql14Packages.temporal_tables
- postgresql15Packages.temporal_tables
- postgresql16Packages.temporal_tables
- postgresql18Packages.temporal_tables
- haskellPackages.temporal-music-notation
- haskellPackages.temporal-music-notation-demo
- haskellPackages.temporal-music-notation-western
8 months, 1 week ago
@LeSuisse accepted 8 months, 1 week ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

Insufficiently specific bounds checking on authorization header could lead to …

temporal

<1.26.3
<1.27.3
<1.28.1

NIXPKGS-2025-0022

published 6 months, 3 weeks ago

          Permalink
          
            CVE-2025-11060
          
        5.7 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          7 months, 2 weeks ago
          
          @LeSuisse
          
              ignored
            
              package surrealdb-migrations
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 3 weeks ago
          
            Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions
          
      https://access.redhat.com/security/cve/CVE-2025-11060
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2394708
    
    issue-trackingx_refsource_REDHAT
  
      https://github.com/surrealdb/surrealdb
    
      https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d…
    
      https://github.com/surrealdb/surrealdb/pull/6247
    
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc
    
      https://surrealdb.com/docs/surrealql/statements/live
    
    surrealdb

            <2.1.9
          
            <2.3.8
          
            <2.2.8
          
            <3.3.0-alpha.7
          
    openshift-service-mesh/istio-cni-rhel9

    openshift-service-mesh/istio-pilot-rhel9

    openshift-service-mesh/istio-proxyv2-rhel9

    openshift-service-mesh/istio-rhel9-operator

    openshift-service-mesh/istio-must-gather-rhel9

    openshift-service-mesh/istio-sail-operator-bundle

    openshift-service-mesh-tech-preview/istio-ztunnel-rhel9

    openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9

NIXPKGS-2025-0020

published 6 months, 3 weeks ago

          Permalink
          
            CVE-2025-54770
          
        4.9 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          6 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          7 months, 2 weeks ago
          
          @LeSuisse
          
              ignored
            
                2 packages
                grub2_pvgrub_image
grub2_pvhgrub_image

          6 months, 3 weeks ago
          
          @LeSuisse
          
              deleted
            
              maintainer @SigmaSquadron
            
          6 months, 3 weeks ago
          
              maintainer.delete
            
          @LeSuisse
          
              added
            
                2 maintainers
                @hehongbo
@digitalrane

          6 months, 3 weeks ago
          
              maintainer.add
            
          @LeSuisse
          
              deleted
            
              maintainer @hehongbo
            
          6 months, 3 weeks ago
          
              maintainer.delete
            
          @LeSuisse
          
              added
            
              maintainer @CertainLach
            
          6 months, 3 weeks ago
          
              maintainer.add
            
          @LeSuisse
          
              deleted
            
                2 maintainers
                @digitalrane
@CertainLach

          6 months, 3 weeks ago
          
              maintainer.delete
            
          @LeSuisse
          
              accepted
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 3 weeks ago
          
            Grub2: use-after-free in net_set_vlan
          
      https://access.redhat.com/security/cve/CVE-2025-54770
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2413813
    
    issue-trackingx_refsource_REDHAT
  
      http://www.openwall.com/lists/oss-security/2025/11/18/4
    
    grub2

            =<2.14
          
    rhcos

Nixpkgs security tracker

Published issues

wb2osz/direwolf <= 1.8 Reachable Assertion DoS

Wget2: arbitrary file write via metalink path traversal in gnu wget2

Insecure direct object reference

wb2osz/direwolf <= 1.8 Stack-based Buffer Overflow DoS

Genymobile/scrcpy <= 3.3.3 Global Buffer Overflow

Limited HTML injection in emails

YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure

Insufficiently specific bounds checking on authorization header could lead to …

Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions

Grub2: use-after-free in net_set_vlan