NIXPKGS-2026-0535

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-29074

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt ignored
2 packages
- nodePackages.svgo
- nodePackages_latest.svgo
6 months, 1 week ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673 x_refsource_CONFIRM

svgo

==>= 3.0.0, < 3.3.3
==>= 2.1.0, < 2.8.1
=== 4.0.0

NIXPKGS-2026-0549

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-29183

9.3 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f x_refsource_CONFIRM

siyuan

==< 3.5.9

NIXPKGS-2026-0527

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-29790
          
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            dbt-common: commonprefix() doesn't protect against path traversal
          
      https://github.com/dbt-labs/dbt-common/security/advisories/GHSA-w75w-9qv4-j5xj
    
    x_refsource_CONFIRM
  
      https://github.com/pypa/pip/pull/13777
    
    x_refsource_MISC
  
      https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709
    
    x_refsource_MISC
  
    dbt-common

            ==< 1.37.3
          
            ==< 1.34.2

NIXPKGS-2026-0555

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-30790
          
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            RustDesk Server Controls All Handshake Entropy (Salt/Challenge), Enabling Offline Brute-Force
          
      https://github.com/rustdesk
    
    product
  
      https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozA…
    
    third-party-advisoryexploit
  
      https://www.vulsec.org/
    
    third-party-advisoryvdb-entry
  
    rustdesk-server

            =<1.1.15
          
    rustdesk-server-pro

            =<1.7.5
          
            Advisory: https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub

NIXPKGS-2026-0532

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-30225
          
        5.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            OliveTin: RestartAction always runs actions as guest
          
      https://github.com/OliveTin/OliveTin/security/advisories/GHSA-p443-p7w5-2f7f
    
    x_refsource_CONFIRM
  
      https://github.com/OliveTin/OliveTin/commit/cb46a597b2465235839ed58cf034b5e7b70ef911
    
    x_refsource_MISC
  
      https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1
    
    x_refsource_MISC
  
    OliveTin

            ==< 3000.11.1

NIXPKGS-2026-0537

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-28804
          
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              ignored
            
                10 packages
                capypdf
python312Packages.pypdf2
python312Packages.pypdf3
python313Packages.pypdf2
python313Packages.pypdf3
python314Packages.pypdf2
python314Packages.pypdf3
python312Packages.pypdfium2
python313Packages.pypdfium2
python314Packages.pypdfium2

          6 months, 1 week ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            pypdf: Inefficient decoding of ASCIIHexDecode streams
          
      https://github.com/py-pdf/pypdf/security/advisories/GHSA-9m86-7pmv-2852
    
    x_refsource_CONFIRM
  
      https://github.com/py-pdf/pypdf/pull/3666
    
    x_refsource_MISC
  
      https://github.com/py-pdf/pypdf/commit/648c627d2657447dfb1773412af05a0a5103b98f
    
    x_refsource_MISC
  
      https://github.com/py-pdf/pypdf/releases/tag/6.7.5
    
    x_refsource_MISC
  
    pypdf

            ==< 6.7.5

NIXPKGS-2026-0542

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-29082

7.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

Kestra: Stored Cross-Site Scripting in Markdown File Preview

https://github.com/kestra-io/kestra/security/advisories/GHSA-r36c-83hm-pc8j x_refsource_CONFIRM
https://github.com/kestra-io/kestra/releases/tag/v1.0.30 x_refsource_MISC

kestra

==<= 1.1.10

NIXPKGS-2026-0547

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-28685
          
        6.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            Kimai: API invoice endpoint missing customer-level access control (IDOR)
          
      https://github.com/kimai/kimai/security/advisories/GHSA-v33r-r6h2-8wr7
    
    x_refsource_CONFIRM
  
      https://github.com/kimai/kimai/commit/a0601c8cb28fed1cca19051a8272425069ab758f
    
    x_refsource_MISC
  
      https://github.com/kimai/kimai/releases/tag/2.51.0
    
    x_refsource_MISC
  
    kimai

            ==< 2.51.0

NIXPKGS-2026-0552

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-29064

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

Zarf: Symlink targets in archives are not validated against destination directory

https://github.com/zarf-dev/zarf/security/advisories/GHSA-hcm4-6hpj-vghm x_refsource_CONFIRM
https://github.com/zarf-dev/zarf/releases/tag/v0.73.1 x_refsource_MISC

zarf

==>= 0.54.0, < 0.73.1

https://github.com/zarf-dev/zarf/security/advisories/GHSA-hcm4-6hpj-vghm

NIXPKGS-2026-0557

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-28342
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint
          
      https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp
    
    x_refsource_CONFIRM
  
      https://github.com/OliveTin/OliveTin/commit/2eb5f0ba79d4bbef3c802bf8b4666a7e18dcfd90
    
    x_refsource_MISC
  
      https://github.com/OliveTin/OliveTin/releases/tag/3000.10.2
    
    x_refsource_MISC
  
    OliveTin

            ==< 3000.10.2

Nixpkgs security tracker

Published issues

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution

dbt-common: commonprefix() doesn't protect against path traversal

RustDesk Server Controls All Handshake Entropy (Salt/Challenge), Enabling Offline Brute-Force

OliveTin: RestartAction always runs actions as guest

pypdf: Inefficient decoding of ASCIIHexDecode streams

Kestra: Stored Cross-Site Scripting in Markdown File Preview

Kimai: API invoice endpoint missing customer-level access control (IDOR)

Zarf: Symlink targets in archives are not validated against destination directory

OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint