NIXPKGS-2026-1406

GitHub issue published 1 month, 2 weeks ago

          Permalink
          
            CVE-2026-33489
          
              updated
            
          1 month, 2 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 month, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              reference https://g…
            
          1 month, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          1 month, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          1 month, 2 weeks ago
          
            CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
          
      https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3
    
    x_refsource_CONFIRMexploit
  
          Ignored references (1)
        
      https://github.com/coredns/coredns/releases/tag/v1.14.3
    
    x_refsource_MISC
  
    coredns

            ==< 1.14.3

NIXPKGS-2026-1405

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-27693

5.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse ignored
7 packages
- python312Packages.pytraccar
- python313Packages.pytraccar
- python314Packages.pytraccar
- home-assistant-component-tests.traccar
- tests.home-assistant-components.traccar
- home-assistant-component-tests.traccar_server
- tests.home-assistant-components.traccar_server
1 month, 3 weeks ago
@LeSuisse ignored reference https://g… 1 month, 3 weeks ago
@LeSuisse accepted 1 month, 3 weeks ago
@LeSuisse published on GitHub 1 month, 2 weeks ago

traccar allows XML injection in KML and GPX exports

https://github.com/traccar/traccar/security/advisories/GHSA-32pj-vrqc-x656 x_refsource_CONFIRM

Ignored references (1)

https://github.com/traccar/traccar/blob/v6.11.0/src/main/java/org/traccar/reports/GpxExportProvider.java#L52-L54 x_refsource_MISC

traccar

==>= 6.11.1, < 6.13.0

NIXPKGS-2026-1404

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-32934

updated 1 month, 2 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse ignored reference https://g… 1 month, 3 weeks ago
@LeSuisse accepted 1 month, 3 weeks ago
@LeSuisse published on GitHub 1 month, 2 weeks ago

CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service

https://github.com/coredns/coredns/security/advisories/GHSA-2wpx-qpw2-g5h5 x_refsource_CONFIRM

Ignored references (1)

https://github.com/coredns/coredns/releases/tag/v1.14.3 x_refsource_MISC

coredns

==< 1.14.3

NIXPKGS-2026-1403

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-27694

5.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse ignored
7 packages
- python312Packages.pytraccar
- python313Packages.pytraccar
- python314Packages.pytraccar
- home-assistant-component-tests.traccar
- tests.home-assistant-components.traccar
- home-assistant-component-tests.traccar_server
- tests.home-assistant-components.traccar_server
1 month, 3 weeks ago
@LeSuisse accepted 1 month, 3 weeks ago
@LeSuisse published on GitHub 1 month, 2 weeks ago

traccar allows stored HTML injection in notification emails

https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv x_refsource_CONFIRMexploit

traccar

==>= 6.11.1, < 6.13.0

NIXPKGS-2026-1401

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42227

updated 1 month, 2 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse ignored
3 packages
- n8n-nodes-carbonejs
- n8n-nodes-evolution-api
- n8n-task-runner-launcher
1 month, 2 weeks ago
@LeSuisse accepted 1 month, 2 weeks ago
@LeSuisse published on GitHub 1 month, 2 weeks ago

n8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure

https://github.com/n8n-io/n8n/security/advisories/GHSA-756q-gq9h-fp22 x_refsource_CONFIRM

n8n

==>= 2.17.0, < 2.17.4
==< 1.123.32
==>= 2.18.0, < 2.18.1

NIXPKGS-2026-1402

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42228

updated 1 month, 2 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse ignored
3 packages
- n8n-nodes-carbonejs
- n8n-nodes-evolution-api
- n8n-task-runner-launcher
1 month, 2 weeks ago
@LeSuisse accepted 1 month, 2 weeks ago
@LeSuisse published on GitHub 1 month, 2 weeks ago

n8n: Hijacking of Unauthenticated Chat Execution

https://github.com/n8n-io/n8n/security/advisories/GHSA-f77h-j2v7-g6mw x_refsource_CONFIRM

n8n

==>= 2.17.0, < 2.17.4
==>= 2.18.0, < 2.18.1
==< 1.123.32

NIXPKGS-2026-1399

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42226

updated 1 month, 2 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse ignored
3 packages
- n8n-nodes-carbonejs
- n8n-nodes-evolution-api
- n8n-task-runner-launcher
1 month, 2 weeks ago
@LeSuisse accepted 1 month, 2 weeks ago
@LeSuisse published on GitHub 1 month, 2 weeks ago

n8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay

https://github.com/n8n-io/n8n/security/advisories/GHSA-r4v6-9fqc-w5jr x_refsource_CONFIRM

n8n

==< 1.123.33
==>= 2.17.0, < 2.17.5

NIXPKGS-2026-1400

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-43964

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 1 month, 2 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse ignored
3 packages
- postfixadmin
- postfix-tlspol
- prometheus-postfix-exporter
1 month, 2 weeks ago
@LeSuisse accepted 1 month, 2 weeks ago
@LeSuisse published on GitHub 1 month, 2 weeks ago

Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 …

Postfix

<3.8.16
<3.10.9
<3.9.10

NIXPKGS-2026-1397

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42232

updated 1 month, 2 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse ignored
3 packages
- n8n-nodes-carbonejs
- n8n-nodes-evolution-api
- n8n-task-runner-launcher
1 month, 2 weeks ago
@LeSuisse accepted 1 month, 2 weeks ago
@LeSuisse published on GitHub 1 month, 2 weeks ago

n8n: XML Node Prototype Pollution to RCE

https://github.com/n8n-io/n8n/security/advisories/GHSA-hqr4-h3xv-9m3r x_refsource_CONFIRM

n8n

==>= 2.17.0, < 2.17.4
==>= 2.18.0, < 2.18.1
==< 1.123.32

NIXPKGS-2026-1398

GitHub issue published 1 month, 2 weeks ago

Permalink CVE-2026-42231

updated 1 month, 2 weeks ago by @LeSuisse Activity log

Created suggestion 1 month, 3 weeks ago
@LeSuisse ignored
3 packages
- n8n-nodes-carbonejs
- n8n-nodes-evolution-api
- n8n-task-runner-launcher
1 month, 2 weeks ago
@LeSuisse accepted 1 month, 2 weeks ago
@LeSuisse published on GitHub 1 month, 2 weeks ago

n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE

https://github.com/n8n-io/n8n/security/advisories/GHSA-q5f4-99jv-pgg5 x_refsource_CONFIRM

n8n

==>= 2.17.0, < 2.17.4
==< 1.123.32
==>= 2.18.0, < 2.18.1

Nixpkgs security tracker

Published issues

CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison

traccar allows XML injection in KML and GPX exports

CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service

traccar allows stored HTML injection in notification emails

n8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure

n8n: Hijacking of Unauthenticated Chat Execution

n8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay

Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 …

n8n: XML Node Prototype Pollution to RCE

n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE