NIXPKGS-2026-0386

GitHub issue published 7 months ago

Permalink CVE-2026-27116

6.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored package vikunja-desktop 7 months ago
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

Vikunja has Reflected HTML Injection via filter Parameter in Projects Module

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qgr-4h56-8895 x_refsource_CONFIRM
https://vikunja.io/changelog/vikunja-v2.0.0-was-released x_refsource_MISC

vikunja

==< 2.0.0

Upstream advisory: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qgr-4h56-8895

NIXPKGS-2026-0385

GitHub issue published 7 months ago

Permalink CVE-2026-27575

9.1 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored package vikunja-desktop 7 months ago
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3ccg-x393-96v8 x_refsource_CONFIRM
https://vikunja.io/changelog/vikunja-v2.0.0-was-released x_refsource_MISC

vikunja

==< 2.0.0

Upstream advisory: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3ccg-x393-96v8

NIXPKGS-2026-0384

GitHub issue published 7 months ago

Permalink CVE-2026-27819

7.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored package vikunja-desktop 7 months ago
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

Vikunja has Path Traversal in CLI Restore

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-42wg-38gx-85rh x_refsource_CONFIRM
https://vikunja.io/changelog/vikunja-v2.0.0-was-released x_refsource_MISC

vikunja

==< 2.0.0

Upstream advisory: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-42wg-38gx-85rh

NIXPKGS-2026-0383

GitHub issue published 7 months ago

          Permalink
          
            CVE-2026-26104
          
        5.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): None (N)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): None (N)
        
              updated
            
          7 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          7 months ago
          
          @LeSuisse
          
              ignored
            
              package deepin.udisks2-qt5
            
          7 months ago
          
          @LeSuisse
          
              accepted
            
          7 months ago
          
          @LeSuisse
          
              published on GitHub
            
          7 months ago
          
            Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api
          
      https://access.redhat.com/security/cve/CVE-2026-26104
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2433717
    
    x_refsource_REDHATissue-tracking
  
    udisks

    udisks2

            Upstream advisory: https://github.com/storaged-project/udisks/security/advisories/GHSA-fcvx-497g-6xmw
Upstream patch: https://github.com/storaged-project/udisks/commit/4353c0610089218ac4813edc05cc1662b7a9d6dd

NIXPKGS-2026-0382

GitHub issue published 7 months ago

Permalink CVE-2026-27611

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
4 packages
- filebrowser
- python312Packages.filebrowser-safe
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
7 months ago
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

FileBrowser Quantum: Password Protection Not Enforced on Shared File Links

https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8vrh-3pm2-v4v6 x_refsource_CONFIRM
https://github.com/gtsteffaniak/filebrowser/commit/c51b0ee9738fa4599b409f47c5bf820ef31b4fe1 x_refsource_MISC

filebrowser

==>= 1.2.0-beta, < 1.2.6-beta
==< 1.1.3-stable

Upstream advisory: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8vrh-3pm2-v4v6
Upstream patch: https://github.com/gtsteffaniak/filebrowser/commit/c51b0ee9738fa4599b409f47c5bf820ef31b4fe1

NIXPKGS-2026-0464

GitHub issue published 7 months ago

Permalink CVE-2026-25985

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
7 months ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
7 months ago maintainer.delete
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

Memory allocation with excessive without limits in the internal SVG decoder

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v7g2-m8c5-mf84 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0465

GitHub issue published 7 months ago

Permalink CVE-2026-25966

5.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
7 months ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
7 months ago maintainer.delete
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xwc6-v6g8-pw2h x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0466

GitHub issue published 7 months ago

Permalink CVE-2026-25987

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
7 months ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
7 months ago maintainer.delete
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

ImageMagick has heap buffer over-read in MAP image decoder

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-42p5-62qq-mmh7 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0467

GitHub issue published 7 months ago

Permalink CVE-2026-25989

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
7 months ago
@LeSuisse deleted
3 maintainers
- @faukah
- @dotlambda
- @rhendric
7 months ago maintainer.delete
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7355-pwx2-pm84 x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

NIXPKGS-2026-0468

GitHub issue published 7 months ago

Permalink CVE-2026-25796

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
3 packages
- tests.pkg-config.defaultPkgConfigPackages.ImageMagick
- tests.pkg-config.defaultPkgConfigPackages.MagickWand
- graphicsmagick-imagemagick-compat
7 months ago
@LeSuisse deleted
3 maintainers
- @faukah
- @rhendric
- @dotlambda
7 months ago maintainer.delete
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g2pr-qxjg-7r2w x_refsource_CONFIRM

ImageMagick

==>= 7.0.0, < 7.1.2-15
==< 6.9.13-40

Nixpkgs security tracker

Published issues

Vikunja has Reflected HTML Injection via filter Parameter in Projects Module

Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

Vikunja has Path Traversal in CLI Restore

Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api

FileBrowser Quantum: Password Protection Not Enforced on Shared File Links

Memory allocation with excessive without limits in the internal SVG decoder

ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

ImageMagick has heap buffer over-read in MAP image decoder

ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths