NIXPKGS-2026-0515

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-27801

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored package vaultwarden-webvault 6 months, 2 weeks ago
@LeSuisse accepted 6 months, 2 weeks ago
@LeSuisse deleted
2 maintainers
- @dotlambda
- @SuperSandro2000
6 months, 2 weeks ago maintainer.delete
@LeSuisse published on GitHub 6 months, 2 weeks ago

Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-v6pg-v89r-w8wr x_refsource_CONFIRM

vaultwarden

==< 1.35.0

Upstream advisory: https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-v6pg-v89r-w8wr

NIXPKGS-2026-0510

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-27622

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored
2 packages
- haskellPackages.openexr-write
- openexrid-unstable
6 months, 2 weeks ago
@LeSuisse accepted 6 months, 2 weeks ago
@LeSuisse published on GitHub 6 months, 2 weeks ago

OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963 x_refsource_CONFIRM

openexr

==>= 3.3.0, < 3.3.8
==>= 2.3.0, < 3.2.6
==>= 3.4.0, < 3.4.6

Upstream advisory: https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963

NIXPKGS-2026-0509

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-27905

updated 6 months, 2 weeks ago by @mweinelt Activity log

Created suggestion 6 months, 2 weeks ago
@mweinelt accepted 6 months, 2 weeks ago
@mweinelt published on GitHub 6 months, 2 weeks ago

BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction

https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf x_refsource_CONFIRM
https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670 x_refsource_MISC

BentoML

==< 1.4.36

https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670
https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf

NIXPKGS-2026-0514

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-26272

4.6 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse accepted 6 months, 2 weeks ago
@LeSuisse published on GitHub 6 months, 2 weeks ago

HomeBox affected by Stored XSS via HTML/SVG Attachment Upload

https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr x_refsource_CONFIRM
https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892 x_refsource_MISC

homebox

==< 0.24.0-rc.1

Upstream advisory: https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr
Upstream patch: https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892

NIXPKGS-2026-0511

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-27932

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse accepted 6 months, 2 weeks ago
@LeSuisse published on GitHub 6 months, 2 weeks ago

joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

https://github.com/authlib/joserfc/security/advisories/GHSA-w5r5-m38g-f9f9 x_refsource_CONFIRM
https://github.com/authlib/joserfc/commit/696a9611ab982c45ee2190ed79ca8e1d8e09398f x_refsource_MISC

joserfc

==<= 1.6.2

Upstream advisory: https://github.com/authlib/joserfc/security/advisories/GHSA-w5r5-m38g-f9f9
Upstream patch: https://github.com/authlib/joserfc/commit/696a9611ab982c45ee2190ed79ca8e1d8e09398f

NIXPKGS-2026-0512

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-27600

5.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse accepted 6 months, 2 weeks ago
@LeSuisse published on GitHub 6 months, 2 weeks ago

HomeBox affected by Blind SSRF

https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-cm7p-5mg5-82pm x_refsource_CONFIRM

homebox

==< 0.24.0-rc.1

Upstream advisory: https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-cm7p-5mg5-82pm

NIXPKGS-2026-0513

GitHub issue published 6 months, 2 weeks ago

Permalink CVE-2026-27981

7.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse accepted 6 months, 2 weeks ago
@LeSuisse published on GitHub 6 months, 2 weeks ago

HomeBox has an Auth Rate Limit Bypass via IP Spoofing

https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-j86g-v96v-jpp3 x_refsource_CONFIRM

homebox

==< 0.24.0

Upstream advisory: https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-j86g-v96v-jpp3

NIXPKGS-2026-0497

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-3407
          
        3.3 LOW
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): Low (L)
        
          Exploit Code Maturity (E): Proof-of-Concept (P)
        
          Remediation Level (RL): Official Fix (O)
        
          Report Confidence (RC): Confirmed (C)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          6 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @LeSuisse
          
              ignored
            
                6 packages
                yosys-ghdl
yosys-synlig
yosys-bluespec
python312Packages.yosys
python313Packages.yosys
python314Packages.yosys

          6 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 2 weeks ago
          
            YosysHQ yosys BLIF File rtlil.h set heap-based overflow
          
      VDB-348302 | YosysHQ yosys BLIF File rtlil.h set heap-based overflow
    
    technical-descriptionvdb-entry
  
      VDB-348302 | CTI Indicators (IOB, IOC, IOA)
    
    permissions-requiredsignature
  
      Submit #763755 | YosysHQ yosys 8bbde80 Heap-based Buffer Overflow
    
    third-party-advisory
  
      https://github.com/YosysHQ/yosys/issues/5677
    
    issue-tracking
  
      https://github.com/YosysHQ/yosys/pull/5680
    
    patchissue-tracking
  
      https://github.com/oneafter/0210/blob/main/yo2/repro
    
    exploit
  
      https://github.com/YosysHQ/yosys/pull/5681
    
    patchissue-tracking
  
      https://github.com/YosysHQ/yosys/
    
    product
  
    yosys

            ==0.41
          
            ==0.23
          
            ==0.42
          
            ==0.54
          
            ==0.44
          
            ==0.13
          
            ==0.17
          
            ==0.53
          
            ==0.57
          
            ==0.9
          
            ==0.16
          
            ==0.28
          
            ==0.60
          
            ==0.2
          
            ==0.47
          
            ==0.14
          
            ==0.11
          
            ==0.1
          
            ==0.45
          
            ==0.52
          
            ==0.3
          
            ==0.39
          
            ==0.19
          
            ==0.33
          
            ==0.5
          
            ==0.59
          
            ==0.56
          
            ==0.22
          
            ==0.38
          
            ==0.49
          
            ==0.50
          
            ==0.18
          
            ==0.34
          
            ==0.30
          
            ==0.21
          
            ==0.20
          
            ==0.61
          
            ==0.6
          
            ==0.24
          
            ==0.29
          
            ==0.25
          
            ==0.43
          
            ==0.4
          
            ==0.62
          
            ==0.32
          
            ==0.7
          
            ==0.12
          
            ==0.40
          
            ==0.51
          
            ==0.55
          
            ==0.26
          
            ==0.36
          
            ==0.27
          
            ==0.46
          
            ==0.35
          
            ==0.15
          
            ==0.37
          
            ==0.58
          
            ==0.8
          
            ==0.31
          
            ==0.48
          
            ==0.10
          
            Upstream issue: https://github.com/YosysHQ/yosys/issues/5677
PRs:
* https://github.com/YosysHQ/yosys/pull/5680
* https://github.com/YosysHQ/yosys/pull/5681

NIXPKGS-2026-0503

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-3337
          
        5.9 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 2 weeks ago
          
            Timing Side-Channel in AES-CCM Tag Verification in AWS-LC
          
      https://aws.amazon.com/security/security-bulletins/2026-005-AWS/
    
    vendor-advisory
  
      https://github.com/aws/aws-lc/releases/tag/v1.69.0
    
    patch
  
      https://github.com/aws/aws-lc/security/advisories/GHSA-frmv-5gcm-jwxh
    
    third-party-advisory
  
    AWS-LC

            <1.69.0
          
    AWS-LC-FIPS

            <3.2.0
          
            Upstream advisory: https://github.com/aws/aws-lc/security/advisories/GHSA-frmv-5gcm-jwxh

NIXPKGS-2026-0495

GitHub issue published 6 months, 2 weeks ago

          Permalink
          
            CVE-2026-27631
          
              updated
            
          6 months, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 2 weeks ago
          
          @LeSuisse
          
              ignored
            
                10 packages
                gexiv2
libsForQt5.libkexiv2
kdePackages.libkexiv2
python312Packages.exiv2
python313Packages.exiv2
python314Packages.exiv2
plasma5Packages.libkexiv2
python312Packages.py3exiv2
python313Packages.py3exiv2
python314Packages.py3exiv2

          6 months, 2 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 2 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 2 weeks ago
          
            Exiv2: Uncaught exception - cannot create std::vector larger than max_size()
          
      https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j
    
    x_refsource_CONFIRM
  
      https://github.com/Exiv2/exiv2/issues/3513
    
    x_refsource_MISC
  
      https://github.com/Exiv2/exiv2/pull/3514
    
    x_refsource_MISC
  
      https://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df
    
    x_refsource_MISC
  
    exiv2

            ==< 0.28.8
          
            Upstream advisory: https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j
Upstream patch: https://github.com/Exiv2/exiv2/commit/659db316eef745899a778a1e0b760a971d1b69df

Nixpkgs security tracker

Published issues

Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction

HomeBox affected by Stored XSS via HTML/SVG Attachment Upload

joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

HomeBox affected by Blind SSRF

HomeBox has an Auth Rate Limit Bypass via IP Spoofing

YosysHQ yosys BLIF File rtlil.h set heap-based overflow

Timing Side-Channel in AES-CCM Tag Verification in AWS-LC

Exiv2: Uncaught exception - cannot create std::vector larger than max_size()