NIXPKGS-2026-0349

GitHub issue published 7 months ago

          Permalink
          
            CVE-2026-27571
          
        5.9 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          7 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          7 months ago
          
          @LeSuisse
          
              accepted
            
          7 months ago
          
          @LeSuisse
          
              published on GitHub
            
          7 months ago
          
            nats-server websockets are vulnerable to pre-auth memory DoS
          
      https://github.com/nats-io/nats-server/security/advisories/GHSA-qrvq-68c2-7grw
    
    x_refsource_CONFIRM
  
      https://github.com/nats-io/nats-server/commit/f77fb7c4535e6727cc1a2899cd8e6bbdd8ba2017
    
    x_refsource_MISC
  
      https://github.com/nats-io/nats-server/releases/tag/v2.11.12
    
    x_refsource_MISC
  
      https://github.com/nats-io/nats-server/releases/tag/v2.12.3
    
    x_refsource_MISC
  
    nats-server

            ==< 2.11.12
          
            ==>= 2.12.0-RC.1, < 2.12.3
          
            Upstream advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-qrvq-68c2-7grw
Upstream patch: https://github.com/nats-io/nats-server/commit/f77fb7c4535e6727cc1a2899cd8e6bbdd8ba2017

NIXPKGS-2026-0348

GitHub issue published 7 months ago

          Permalink
          
            CVE-2026-26981
          
        6.5 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          7 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          7 months ago
          
          @LeSuisse
          
              ignored
            
                3 packages
                openexrid-unstable
haskellPackages.openexr-write
openexr_2

          7 months ago
          
          @LeSuisse
          
              accepted
            
          7 months ago
          
          @LeSuisse
          
              published on GitHub
            
          7 months ago
          
            OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
          
      https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-q6vj-wxvf-5m8c
    
    x_refsource_CONFIRM
  
      https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef
    
    x_refsource_MISC
  
      https://github.com/AcademySoftwareFoundation/openexr/commit/d2be382758adc3e9ab83a3de35138ec28d93ebd8
    
    x_refsource_MISC
  
    openexr

            ==>= 3.4.0, < 3.4.5
          
            ==>= 3.3.0, < 3.3.7
          
            Upstream advisory: https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-q6vj-wxvf-5m8c
Upstream patch: https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef

NIXPKGS-2026-0347

GitHub issue published 7 months ago

Permalink CVE-2026-3203

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse deleted
2 maintainers
- @fpletz
- @bjornfor
7 months ago maintainer.delete
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

Buffer Over-read in Wireshark

https://www.wireshark.org/security/wnpa-sec-2026-07.html
GitLab Issue #21009 permissions-requiredissue-tracking

Wireshark

<4.6.4
<4.4.14

Upstream advisory: https://www.wireshark.org/security/wnpa-sec-2026-07.html

NIXPKGS-2026-0346

GitHub issue published 7 months ago

Permalink CVE-2026-3201

4.7 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse deleted
2 maintainers
- @fpletz
- @bjornfor
7 months ago maintainer.delete
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

Improperly Controlled Sequential Memory Allocation in Wireshark

https://www.wireshark.org/security/wnpa-sec-2026-05.html
GitLab Issue #20972 permissions-requiredissue-tracking

Wireshark

<4.6.4
<4.4.14

Upstream advisory: https://www.wireshark.org/security/wnpa-sec-2026-05.html

NIXPKGS-2026-0345

GitHub issue published 7 months ago

Permalink CVE-2026-3202

4.7 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse deleted
2 maintainers
- @bjornfor
- @fpletz
7 months ago maintainer.delete
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

NULL Pointer Dereference in Wireshark

https://www.wireshark.org/security/wnpa-sec-2026-06.html
GitLab Issue #21000 permissions-requiredissue-tracking

Wireshark

<4.6.4

Upstream advisory: https://www.wireshark.org/security/wnpa-sec-2026-06.html

NIXPKGS-2026-0344

GitHub issue published 7 months ago

Permalink CVE-2026-27963

4.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
4 packages
- pkgsRocm.audiobookshelf
- python312Packages.aioaudiobookshelf
- python313Packages.aioaudiobookshelf
- python314Packages.aioaudiobookshelf
7 months ago
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata

https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78 x_refsource_CONFIRM
https://github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478 x_refsource_MISC

audiobookshelf

==< 2.32.0

Upstream advisory: https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-69cp-m725-wf78
Upstream patch: https://github.com/advplyr/audiobookshelf/commit/503f4611b221a5bde19024e657021670df204478

NIXPKGS-2026-0343

GitHub issue published 7 months ago

Permalink CVE-2026-25963

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
20 packages
- fleetctl
- fleeting-plugin-aws
- azure-cli-extensions.fleet
- python312Packages.tesla-fleet-api
- python313Packages.tesla-fleet-api
- python314Packages.tesla-fleet-api
- haskellPackages.amazonka-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python312Packages.mypy-boto3-iotfleethub
- python313Packages.mypy-boto3-iotfleethub
- python314Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleetwise
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleetwise
- home-assistant-component-tests.tesla_fleet
- python312Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleethub
- python312Packages.types-aiobotocore-iotfleetwise
- python313Packages.types-aiobotocore-iotfleetwise
- tests.home-assistant-component-tests.tesla_fleet
7 months ago
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

Fleet: Authorization Bypass in certificate template batch deletion for team administrators

https://github.com/fleetdm/fleet/security/advisories/GHSA-5jvp-m9h4-253h x_refsource_CONFIRM

fleet

==< 4.80.1

Upstream advisory: https://github.com/fleetdm/fleet/security/advisories/GHSA-5jvp-m9h4-253h

NIXPKGS-2026-0342

GitHub issue published 7 months ago

Permalink CVE-2026-26186

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
20 packages
- fleetctl
- fleeting-plugin-aws
- azure-cli-extensions.fleet
- python312Packages.tesla-fleet-api
- python313Packages.tesla-fleet-api
- python314Packages.tesla-fleet-api
- haskellPackages.amazonka-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python312Packages.mypy-boto3-iotfleethub
- python313Packages.mypy-boto3-iotfleethub
- python314Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleetwise
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleetwise
- home-assistant-component-tests.tesla_fleet
- python312Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleethub
- python312Packages.types-aiobotocore-iotfleetwise
- python313Packages.types-aiobotocore-iotfleetwise
- tests.home-assistant-component-tests.tesla_fleet
7 months ago
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

Fleet has a SQL injection via backtick escape in ORDER BY parameter

https://github.com/fleetdm/fleet/security/advisories/GHSA-49xw-vfc4-7p43 x_refsource_CONFIRM

fleet

==< 4.80.1

Upstream advisory: https://github.com/fleetdm/fleet/security/advisories/GHSA-49xw-vfc4-7p43

NIXPKGS-2026-0341

GitHub issue published 7 months ago

Permalink CVE-2026-27465

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
20 packages
- fleetctl
- fleeting-plugin-aws
- azure-cli-extensions.fleet
- python312Packages.tesla-fleet-api
- python313Packages.tesla-fleet-api
- python314Packages.tesla-fleet-api
- haskellPackages.amazonka-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python312Packages.mypy-boto3-iotfleethub
- python313Packages.mypy-boto3-iotfleethub
- python314Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleetwise
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleetwise
- home-assistant-component-tests.tesla_fleet
- python312Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleethub
- python312Packages.types-aiobotocore-iotfleetwise
- python313Packages.types-aiobotocore-iotfleetwise
- tests.home-assistant-component-tests.tesla_fleet
7 months ago
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users

https://github.com/fleetdm/fleet/security/advisories/GHSA-2v6m-6xw3-6467 x_refsource_CONFIRM

fleet

==< 4.80.1

Upstream advisory: https://github.com/fleetdm/fleet/security/advisories/GHSA-2v6m-6xw3-6467

NIXPKGS-2026-0340

GitHub issue published 7 months ago

Permalink CVE-2026-23999

updated 7 months ago by @LeSuisse Activity log

Created suggestion 7 months ago
@LeSuisse ignored
20 packages
- fleetctl
- fleeting-plugin-aws
- azure-cli-extensions.fleet
- python312Packages.tesla-fleet-api
- python313Packages.tesla-fleet-api
- python314Packages.tesla-fleet-api
- haskellPackages.amazonka-iotfleethub
- haskellPackages.amazonka-iotfleetwise
- python312Packages.mypy-boto3-iotfleethub
- python313Packages.mypy-boto3-iotfleethub
- python314Packages.mypy-boto3-iotfleethub
- python312Packages.mypy-boto3-iotfleetwise
- python313Packages.mypy-boto3-iotfleetwise
- python314Packages.mypy-boto3-iotfleetwise
- home-assistant-component-tests.tesla_fleet
- python312Packages.types-aiobotocore-iotfleethub
- python313Packages.types-aiobotocore-iotfleethub
- python312Packages.types-aiobotocore-iotfleetwise
- python313Packages.types-aiobotocore-iotfleetwise
- tests.home-assistant-component-tests.tesla_fleet
7 months ago
@LeSuisse accepted 7 months ago
@LeSuisse published on GitHub 7 months ago

Fleet: Device lock PIN can be predicted if lock time is known

https://github.com/fleetdm/fleet/security/advisories/GHSA-ppwx-5jq7-px2w x_refsource_CONFIRM

fleet

==< 4.80.1

Upstream advisory: https://github.com/fleetdm/fleet/security/advisories/GHSA-ppwx-5jq7-px2w

Nixpkgs security tracker

Published issues

nats-server websockets are vulnerable to pre-auth memory DoS

OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp

Buffer Over-read in Wireshark

Improperly Controlled Sequential Memory Allocation in Wireshark

NULL Pointer Dereference in Wireshark

Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata

Fleet: Authorization Bypass in certificate template batch deletion for team administrators

Fleet has a SQL injection via backtick escape in ORDER BY parameter

Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users

Fleet: Device lock PIN can be predicted if lock time is known