NIXPKGS-2026-0432

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-28218

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 3 weeks ago
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution

https://github.com/discourse/discourse/security/advisories/GHSA-jxrc-72mr-mfh5 x_refsource_CONFIRM

discourse

==>= 2026.1.0-latest, < 2026.1.1
==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-jxrc-72mr-mfh5

NIXPKGS-2026-0431

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-27162

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 3 weeks ago
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

DIscourse doesn't prevent whispers to leak in excerpts

https://github.com/discourse/discourse/security/advisories/GHSA-gffm-43j4-372w x_refsource_CONFIRM

discourse

==>= 2026.1.0-latest, < 2026.1.1
==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-gffm-43j4-372w

NIXPKGS-2026-0430

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-26265

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 3 weeks ago
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse has IDOR vulnerability in the directory items endpoint

https://github.com/discourse/discourse/security/advisories/GHSA-crxf-p6jm-vpgw x_refsource_CONFIRM

discourse

==>= 2026.1.0-latest, < 2026.1.1
==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-crxf-p6jm-vpgw

NIXPKGS-2026-0429

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-27152

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 3 weeks ago
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

DIscourse has DM communication-preference bypass when adding members

https://github.com/discourse/discourse/security/advisories/GHSA-f8ff-pxg3-7967 x_refsource_CONFIRM

discourse

==>= 2026.1.0-latest, < 2026.1.1
==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-f8ff-pxg3-7967

NIXPKGS-2026-0428

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-27149

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 3 weeks ago
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse has SQL injection in PM tag filtering

https://github.com/discourse/discourse/security/advisories/GHSA-m6qf-h49w-h38w x_refsource_CONFIRM

discourse

==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0
==>= 2026.1.0-latest, < 2026.1.1

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-m6qf-h49w-h38w

NIXPKGS-2026-0427

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-27150

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 3 weeks ago
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse doesn't ensure guardian check when creating QueryGroupBookmark

https://github.com/discourse/discourse/security/advisories/GHSA-rw95-54qr-qrw8 x_refsource_CONFIRM

discourse

==>= 2026.1.0-latest, < 2026.1.1
==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-rw95-54qr-qrw8

NIXPKGS-2026-0426

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-27151

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 3 weeks ago
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

Discourse doesn't validate destination topic when moving posts

https://github.com/discourse/discourse/security/advisories/GHSA-m69h-9m2g-cfgw x_refsource_CONFIRM

discourse

==>= 2026.1.0-latest, < 2026.1.1
==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-m69h-9m2g-cfgw

NIXPKGS-2026-0425

GitHub issue published 6 months, 3 weeks ago

Permalink CVE-2026-28215

9.1 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 3 weeks ago
@LeSuisse accepted 6 months, 3 weeks ago
@LeSuisse published on GitHub 6 months, 3 weeks ago

hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover

https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg x_refsource_CONFIRM
https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0 x_refsource_MISC

hoppscotch

==< 2026.2.0

Upstream advisory: https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg

NIXPKGS-2026-0424

GitHub issue published 6 months, 3 weeks ago

          Permalink
          
            CVE-2026-28296
          
        4.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): Low (L)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): Low (L)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          6 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 3 weeks ago
          
            Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths
          
      https://access.redhat.com/security/cve/CVE-2026-28296
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2443003
    
    x_refsource_REDHATissue-tracking
  
    gvfs

            Upstream issue: https://gitlab.gnome.org/GNOME/gvfs/-/issues/833
Upstream patch: https://gitlab.gnome.org/GNOME/gvfs/-/commit/21dda19047b86c3e92fae668eb9dc80e33ca71fd

NIXPKGS-2026-0423

GitHub issue published 6 months, 3 weeks ago

          Permalink
          
            CVE-2026-27969
          
              updated
            
          6 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          6 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          6 months, 3 weeks ago
          
            Vitess users with backup storage access can write to arbitrary file paths on restore
          
      https://github.com/vitessio/vitess/security/advisories/GHSA-r492-hjgh-c9gw
    
    x_refsource_CONFIRM
  
      https://github.com/vitessio/vitess/pull/19470
    
    x_refsource_MISC
  
      https://github.com/vitessio/vitess/commit/c565cab615bc962bda061dcd645aa7506c59ca4a
    
    x_refsource_MISC
  
    vitess

            ==>= 23.0.0, < 23.0.3
          
            ==< 22.0.4
          
            Upstream advisory: https://github.com/vitessio/vitess/security/advisories/GHSA-r492-hjgh-c9gw
Upstream patch: https://github.com/vitessio/vitess/commit/c565cab615bc962bda061dcd645aa7506c59ca4a

Nixpkgs security tracker

Published issues

Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution

DIscourse doesn't prevent whispers to leak in excerpts

Discourse has IDOR vulnerability in the directory items endpoint

DIscourse has DM communication-preference bypass when adding members

Discourse has SQL injection in PM tag filtering

Discourse doesn't ensure guardian check when creating QueryGroupBookmark

Discourse doesn't validate destination topic when moving posts

hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover

Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths

Vitess users with backup storage access can write to arbitrary file paths on restore