NIXPKGS-2026-0562

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-29188
          
        9.1 CRITICAL
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              ignored
            
                4 packages
                python314Packages.filebrowser-safe
python313Packages.filebrowser-safe
python312Packages.filebrowser-safe
filebrowser-quantum

          6 months, 1 week ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            File Browser: TUS Delete Endpoint Bypasses Delete Permission Check
          
      https://github.com/filebrowser/filebrowser/security/advisories/GHSA-79pf-vx4x-7jmm
    
    x_refsource_CONFIRM
  
      https://github.com/filebrowser/filebrowser/commit/7ed1425115be602c2b23236c410098ea2d74b42f
    
    x_refsource_MISC
  
      https://github.com/filebrowser/filebrowser/releases/tag/v2.61.1
    
    x_refsource_MISC
  
    filebrowser

            ==< 2.61.1

NIXPKGS-2026-0541

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-29059

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly

https://github.com/windmill-labs/windmill/security/advisories/GHSA-24fr-44f8-fqwg x_refsource_CONFIRM
https://github.com/windmill-labs/windmill/releases/tag/v1.603.3 x_refsource_MISC

windmill

==< 1.603.3

NIXPKGS-2026-0536

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-29084

4.6 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

Gokapi: CSRF in Login Endpoint

https://github.com/Forceu/Gokapi/security/advisories/GHSA-hcff-qv74-7hr4 x_refsource_CONFIRM
https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC

Gokapi

==< 2.2.3

NIXPKGS-2026-0533

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-29178
          
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              ignored
            
                2 packages
                lemmy-ui
lemmy-help

          6 months, 1 week ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint
          
      https://github.com/LemmyNet/lemmy/security/advisories/GHSA-jvxv-2jjp-jxc3
    
    x_refsource_CONFIRMexploit
  
      https://github.com/LemmyNet/lemmy/commit/f47a03f56d1797bceab5f34b6f624c91cecd5871
    
    x_refsource_MISC
  
    lemmy

            ==< 0.19.16

NIXPKGS-2026-0538

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-30224
          
        5.4 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session
          
      https://github.com/OliveTin/OliveTin/security/advisories/GHSA-gq2m-77hf-vwgh
    
    x_refsource_CONFIRM
  
      https://github.com/OliveTin/OliveTin/commit/d6a0abc3755d43107be1939567c52953bcbec3d5
    
    x_refsource_MISC
  
      https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1
    
    x_refsource_MISC
  
    OliveTin

            ==< 3000.11.1

NIXPKGS-2026-0531

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-28682

6.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

Gokapi: Data Leak in Upload Status Stream

https://github.com/Forceu/Gokapi/security/advisories/GHSA-c36c-7pc2-f2ph x_refsource_CONFIRM
https://github.com/Forceu/Gokapi/releases/tag/v2.2.3 x_refsource_MISC

Gokapi

==< 2.2.3

NIXPKGS-2026-0540

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-28802
          
              updated
            
          6 months, 1 week ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @mweinelt
          
              ignored
            
                15 packages
                python314Packages.google-auth-oauthlib
python313Packages.google-auth-oauthlib
python312Packages.google-auth-oauthlib
python314Packages.requests-oauthlib
python313Packages.requests-oauthlib
python312Packages.requests-oauthlib
python314Packages.aiohttp-oauthlib
python313Packages.aiohttp-oauthlib
python312Packages.aiohttp-oauthlib
python314Packages.hawkauthlib
python313Packages.hawkauthlib
python312Packages.hawkauthlib
python314Packages.oauthlib
python313Packages.oauthlib
python312Packages.oauthlib

          6 months, 1 week ago
          
          @mweinelt
          
              accepted
            
          6 months, 1 week ago
          
          @mweinelt
          
              published on GitHub
            
          6 months, 1 week ago
          
            Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
          
      https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg
    
    x_refsource_CONFIRM
  
      https://github.com/authlib/authlib/commit/a61c2acb807496e67f32051b5f1b1d5ccf8f0a75
    
    x_refsource_MISC
  
      https://github.com/authlib/authlib/commit/b87c32ed07b8ae7f805873e1c9cafd1016761df7
    
    x_refsource_MISC
  
    authlib

            ==>= 1.6.5, < 1.6.7
          
            https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg
https://github.com/authlib/authlib/commit/a61c2acb807496e67f32051b5f1b1d5ccf8f0a75
https://github.com/authlib/authlib/commit/b87c32ed07b8ae7f805873e1c9cafd1016761df7

NIXPKGS-2026-0563

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-27982

updated 6 months, 1 week ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 1 week ago
@mweinelt published on GitHub 6 months, 1 week ago

An open redirect vulnerability exists in django-allauth versions prior to …

django-allauth

==prior to 65.14.1

https://allauth.org/news/2026/02/django-allauth-65.14.1-released/

NIXPKGS-2026-0526

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-28222
          
        6.1 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): High (H)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): High (H)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @LeSuisse
          
              ignored
            
                10 packages
                python312Packages.wagtail-localize
python313Packages.wagtail-localize
python314Packages.wagtail-localize
python312Packages.wagtail-factories
python313Packages.wagtail-factories
python314Packages.wagtail-factories
python312Packages.wagtail-modeladmin
python314Packages.wagtail
python313Packages.wagtail-modeladmin
python314Packages.wagtail-modeladmin

          6 months, 2 weeks ago
          
          @LeSuisse
          
              restored
            
              package python314Packages.wagtail
            
          6 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 2 weeks ago
          
            Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes
          
      https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm
    
    x_refsource_CONFIRM
  
      https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d
    
    x_refsource_MISC
  
      https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e
    
    x_refsource_MISC
  
      https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85
    
    x_refsource_MISC
  
      https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b
    
    x_refsource_MISC
  
      https://github.com/wagtail/wagtail/releases/tag/v6.3.8
    
    x_refsource_MISC
  
      https://github.com/wagtail/wagtail/releases/tag/v7.0.6
    
    x_refsource_MISC
  
      https://github.com/wagtail/wagtail/releases/tag/v7.2.3
    
    x_refsource_MISC
  
      https://github.com/wagtail/wagtail/releases/tag/v7.3.1
    
    x_refsource_MISC
  
    wagtail

            ==>= 7.1rc1, < 7.2.3
          
            ==>= 6.4rc1, < 7.0.6
          
            ==>= 7.3rc1, < 7.3.1
          
            ==< 6.3.8
          
            Upstream advisory: https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm
Patch:
* 7.3.x: https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85
* 7.2.x: https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b

NIXPKGS-2026-0525

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-25048

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse accepted 6 months, 2 weeks ago
@LeSuisse published on GitHub 6 months, 2 weeks ago

xgrammar: Multi-layer nesting causes DoS

https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3 x_refsource_CONFIRM
https://github.com/mlc-ai/xgrammar/releases/tag/v0.1.32 x_refsource_MISC

xgrammar

==< 0.1.32

Upstream advisory: https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3

Nixpkgs security tracker

Published issues

File Browser: TUS Delete Endpoint Bypasses Delete Permission Check

Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly

Gokapi: CSRF in Login Endpoint

Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint

OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session

Gokapi: Data Leak in Upload Status Stream

Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

An open redirect vulnerability exists in django-allauth versions prior to …

Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes

xgrammar: Multi-layer nesting causes DoS