NIXPKGS-2026-1076

GitHub issue published 2 months, 1 week ago

Permalink CVE-2026-40385

4.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 2 months, 1 week ago
• @LeSuisse accepted 2 months, 1 week ago
• @LeSuisse published on GitHub 2 months, 1 week ago

In libexif through 0.6.25, an unsigned 32bit integer overflow in …

• https://github.com/libexif/libexif/commit/93003b93e50b3d259bd2227d8775b73a53c35…

---

libexif

• =<0.6.25

No tier 1 or tier 2 support of 32 bits systems.

NIXPKGS-2026-1075

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-32146

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  6 packages

  • vscode-extensions.gleam.gleam
  • tree-sitter-grammars.tree-sitter-gleam
  • vimPlugins.nvim-treesitter-parsers.gleam
  • python312Packages.tree-sitter-grammars.tree-sitter-gleam
  • python313Packages.tree-sitter-grammars.tree-sitter-gleam
  • python314Packages.tree-sitter-grammars.tree-sitter-gleam
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification

• https://github.com/gleam-lang/gleam/security/advisories/GHSA-vq5j-55vx-wq8j relatedvendor-advisory
• https://github.com/gleam-lang/gleam/commit/1aa5d8e594b0aa240bb213fce6ee19c65e6d… patch
• https://github.com/gleam-lang/gleam/commit/55bb36e6d7febfbbc48c4d001e0ae13eb031… patch

Ignored references (2)

• https://cna.erlef.org/cves/CVE-2026-32146.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-32146 related

---

gleam

• *

gleam-lang/gleam

• *

NIXPKGS-2026-1074

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-5774

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  2 packages

  • jujutsu
  • jujuutils
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map

• In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence exploitvdb-entryvendor-advisory
• https://github.com/juju/juju/pull/22206 issue-trackingpatch
• https://github.com/juju/juju/pull/22205 issue-trackingpatch

---

juju

• <2.9.57
• <4.0.6
• <3.6.21

NIXPKGS-2026-1073

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-40188

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

goshs is Missing Write Protection for Parametric Data Values

• https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx x_refsource_CONFIRM
• https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744 x_refsource_MISC
• https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4 x_refsource_MISC

---

goshs

• ==>= 1.0.7, < 2.0.0-beta.4

NIXPKGS-2026-1072

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-6067

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  5 packages

  • nasmfmt
  • tree-sitter-grammars.tree-sitter-nasm
  • vimPlugins.nvim-treesitter-parsers.nasm
  • python314Packages.tree-sitter-grammars.tree-sitter-nasm
  • python313Packages.tree-sitter-grammars.tree-sitter-nasm
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

CVE-2026-6067

• https://github.com/netwide-assembler/nasm/issues/203

---

NASM

• ==nasm-3.02rc5

NIXPKGS-2026-1071

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-5477

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Prefix-substitution forgery via integer overflow in wolfCrypt CMAC

• https://github.com/wolfSSL/wolfssl/pull/10102

---

wolfSSL

• =<5.9.0

NIXPKGS-2026-1070

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-5724

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  19 packages

  • temporal-cli
  • temporal_capi
  • temporal-ui-server
  • haskellPackages.temporal-music-notation-western
  • terraform-providers.temporalio_temporalcloud
  • haskellPackages.temporal-music-notation-demo
  • haskellPackages.temporal-music-notation
  • postgresql18Packages.temporal_tables
  • postgresql17Packages.temporal_tables
  • postgresql16Packages.temporal_tables
  • postgresql15Packages.temporal_tables
  • postgresql14Packages.temporal_tables
  • haskellPackages.temporal-api-protos
  • postgresqlPackages.temporal_tables
  • terraform-providers.temporalcloud
  • haskellPackages.temporal-media
  • python314Packages.temporalio
  • python313Packages.temporalio
  • python312Packages.temporalio
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Missing Authentication on Streaming gRPC Replication Endpoint

• https://github.com/temporalio/temporal/releases/tag/v1.29.6 patch
• https://github.com/temporalio/temporal/releases/tag/v1.30.4 patch
• https://github.com/temporalio/temporal/releases/tag/v1.28.4 patch

---

temporal

• =<1.29.5
• =<1.30.3
• =<1.28.3

NIXPKGS-2026-1069

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-5479

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag

• https://github.com/wolfSSL/wolfssl/pull/10102

---

wolfSSL

• <5.9.1

NIXPKGS-2026-1068

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-40103

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored package vikunja-desktop 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v479-vf79-mg83 x_refsource_CONFIRM
• https://github.com/go-vikunja/vikunja/commit/6a0f39b252a81fa4b19dc56dc889183acc9225ae x_refsource_MISC

Ignored references (2)

• https://github.com/go-vikunja/vikunja/pull/2584 x_refsource_MISC
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC

---

vikunja

• ==< 2.3.0

NIXPKGS-2026-1067

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35596

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored package vikunja-desktop 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hj5c-mhh2-g7jq x_refsource_CONFIRM
• https://github.com/go-vikunja/vikunja/commit/fc216c38afaa51dd56dde7a97343d2148ecf24c1 x_refsource_MISC
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC

Ignored references (1)

• https://github.com/go-vikunja/vikunja/pull/2578 x_refsource_MISC

---

vikunja

• ==< 2.3.0