NIXPKGS-2026-0485

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-27810

6.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored package calibre-web 6 months, 3 weeks ago
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

calibre Vulnerable to HTTP Response Header Injection

https://github.com/kovidgoyal/calibre/security/advisories/GHSA-5fpj-fxw7-8grw x_refsource_CONFIRM

calibre

==< 9.4.0

Upstream advisory: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-5fpj-fxw7-8grw

NIXPKGS-2026-0489

GitHub issue published 6 months, 3 weeks ago

          Permalink
          
            CVE-2026-28338
          
        6.8 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                21 packages
                phpPackages.phpmd
php81Packages.phpmd
php82Packages.phpmd
php83Packages.phpmd
php84Packages.phpmd
php85Packages.phpmd
python312Packages.pyppmd
python313Packages.pyppmd
python314Packages.pyppmd
python312Packages.pmdarima
python313Packages.pmdarima
python314Packages.pmdarima
python312Packages.pytun-pmd3
python313Packages.pytun-pmd3
python314Packages.pytun-pmd3
python312Packages.sslpsk-pmd3
python313Packages.sslpsk-pmd3
python314Packages.sslpsk-pmd3
python312Packages.pmdsky-debug-py
python313Packages.pmdsky-debug-py
python314Packages.pmdsky-debug-py

          6 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 3 weeks ago
          
            PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages
          
      https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r
    
    x_refsource_CONFIRM
  
      https://github.com/pmd/pmd/pull/6475
    
    x_refsource_MISC
  
      https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442
    
    x_refsource_MISC
  
    pmd

            ==< 7.22.0
          
            Upstream advisory: https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r
Upstream patch: https://github.com/pmd/pmd/commit/c140c0e1de5853a08efb84c9f91dfeb015882442

NIXPKGS-2026-0418

GitHub issue published 6 months, 3 weeks ago

          Permalink
          
            CVE-2026-27945
          
              updated
            
          6 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              package zitadel-tools
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 3 weeks ago
          
            ZITADEL has potential SSRF via Actions
          
      https://github.com/zitadel/zitadel/security/advisories/GHSA-7777-fhq9-592v
    
    x_refsource_CONFIRM
  
      https://github.com/zitadel/zitadel/releases/tag/v3.4.7
    
    x_refsource_MISC
  
      https://github.com/zitadel/zitadel/releases/tag/v4.11.0
    
    x_refsource_MISC
  
    zitadel

            ==>= 2.59.0, < 4.11.1
          
            Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-7777-fhq9-592v

NIXPKGS-2026-0463

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-25897

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
3 packages
- graphicsmagick-imagemagick-compat
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
6 months, 3 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 3 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0464

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-25985

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 3 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 3 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

Memory allocation with excessive without limits in the internal SVG decoder

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0465

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-25966

5.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 3 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 3 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xwc6-v6g8-pw2h x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0466

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-25987

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 3 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 3 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

ImageMagick has heap buffer over-read in MAP image decoder

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0467

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-25989

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 3 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @dotlambda
- @rhendric
6 months, 3 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0468

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-25796

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
6 months, 3 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 3 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0452

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-26283

6.2 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
3 packages
- graphicsmagick-imagemagick-compat
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
6 months, 3 weeks ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
6 months, 3 weeks ago maintainer.delete
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

ImageMagick has possible infinite loop in JPEG encoder when using `jpeg:extent`

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gwr3-x37h-h84v x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

Nixpkgs security tracker

Published issues

calibre Vulnerable to HTTP Response Header Injection

PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

ZITADEL has potential SSRF via Actions

ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write

Memory allocation with excessive without limits in the internal SVG decoder

ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

ImageMagick has heap buffer over-read in MAP image decoder

ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

ImageMagick has possible infinite loop in JPEG encoder when using `jpeg:extent`