NIXPKGS-2026-1146

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-41035

7.4 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored
  19 packages

  • grsync
  • rrsync
  • rsyncy
  • btrsync
  • parsync
  • librsync
  • diskrsync
  • openrsync
  • vdirsyncer
  • sqlite-rsync
  • yaziPlugins.rsync
  • python313Packages.btrsync
  • python314Packages.btrsync
  • python312Packages.sysrsync
  • python313Packages.sysrsync
  • python314Packages.sysrsync
  • python312Packages.vdirsyncer
  • python313Packages.vdirsyncer
  • python314Packages.vdirsyncer
  2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted …

• https://www.openwall.com/lists/oss-security/2026/04/16/2
• https://github.com/RsyncProject/rsync/issues/871
• http://www.openwall.com/lists/oss-security/2026/04/16/9

Ignored references (1)

• https://github.com/RsyncProject/rsync/releases

---

rsync

• =<3.4.1

NIXPKGS-2026-1145

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40322

9.0 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x63q-3rcj-hhp5 x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 x_refsource_MISC

---

siyuan

• ==< 3.6.4

NIXPKGS-2026-1144

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40505

3.3 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored
  10 packages

  • python312Packages.pymupdf
  • python313Packages.pymupdf
  • python314Packages.pymupdf
  • python312Packages.pymupdf4llm
  • python313Packages.pymupdf4llm
  • python314Packages.pymupdf4llm
  • zathuraPkgs.zathura_pdf_mupdf
  • python312Packages.pymupdf-fonts
  • python313Packages.pymupdf-fonts
  • python314Packages.pymupdf-fonts
  2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

MuPDF mutool ANSI Injection via Metadata

• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0f17d789fe8c… patch
• https://www.vulncheck.com/advisories/mupdf-mutool-ansi-injection-via-metadata third-party-advisory

---

MuPDF

• <0f17d789fe8c29b41e47663be82514aaca3a4dfb

NIXPKGS-2026-1143

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-31987

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

Apache Airflow: JWT token appearing in logs

• https://github.com/apache/airflow/pull/62964 patch
• https://github.com/apache/airflow/issues/62428 issue-tracking
• https://github.com/apache/airflow/issues/62773 issue-tracking
• https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g vendor-advisory
• http://www.openwall.com/lists/oss-security/2026/04/16/7

---

apache-airflow

• <3.2.0

NIXPKGS-2026-1142

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40259

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7m5h-w69j-qggg x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 x_refsource_MISC

---

siyuan

• ==< 3.6.4
• ==< 0.0.0-20260407035653-2f416e5253f1

NIXPKGS-2026-1141

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40922

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8q5w-mmxf-48jg x_refsource_CONFIRM
• https://github.com/siyuan-note/siyuan/commit/b382f50e1880ed996364509de5a10a72d7409428 x_refsource_MISC

Ignored references (2)

• https://github.com/advisories/GHSA-4663-4mpg-879v x_refsource_MISC
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 x_refsource_MISC

---

siyuan

• ==< 3.6.4

NIXPKGS-2026-1140

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40959

9.3 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored
  2 packages

  • luanti-client
  • luanti-server
  2 months, 1 week ago
• @LeSuisse ignored
  3 maintainers

  • @06kellyjac
  • @fpletz
  • @fgaz
  2 months, 1 week ago maintainer.ignore
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

Luanti 5 before 5.15.2, when LuaJIT is used, allows a …

• https://github.com/luanti-org/luanti/security/advisories/GHSA-g596-mf82-w8c3
• https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557…
• https://github.com/luanti-org/luanti/commit/53cef183e2a85a4daff84ac1a9a7946f940…

---

Luanti

• <5.15.2

NIXPKGS-2026-1139

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-33472

4.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored package cryptomator-cli 2 months, 1 week ago
• @LeSuisse ignored
  2 maintainers

  • @gepbird
  • @bachp
  2 months, 1 week ago maintainer.ignore
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)

• https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9q8x-whrw-x44p x_refsource_CONFIRM
• https://github.com/cryptomator/cryptomator/pull/4179 x_refsource_MISC
• https://github.com/cryptomator/cryptomator/releases/tag/1.19.2 x_refsource_MISC

---

cryptomator

• ==>= 1.19.1, < 1.19.2

NIXPKGS-2026-1138

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40960

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored
  2 packages

  • luanti-client
  • luanti-server
  2 months, 1 week ago
• @LeSuisse ignored
  3 maintainers

  • @fpletz
  • @fgaz
  • @06kellyjac
  2 months, 1 week ago maintainer.ignore
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

Luanti 5 before 5.15.2 sometimes allows unintended access to an …

• https://github.com/luanti-org/luanti/security/advisories/GHSA-22c4-238c-m5j4
• https://github.com/luanti-org/luanti/commit/0faf529bc4b89e70a275ed1162047815118…
• https://github.com/luanti-org/luanti/commit/827fd4cf7f989482b2dad381fa4afd642ea…

---

Luanti

• <5.15.2

NIXPKGS-2026-1137

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-33214

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse ignored
  8 packages

  • python313Packages.weblate-fonts
  • python314Packages.weblate-fonts
  • python312Packages.weblate-schemas
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python312Packages.weblate-language-data
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

Weblate has improper access control for the translation memory API

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-mpf5-3vph-q75r x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/pull/18513 x_refsource_MISC

---

weblate

• ==< 5.17