NIXPKGS-2026-1066

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-40189

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

goshs has a file-based ACL authorization bypass in goshs state-changing routes

• https://github.com/patrickhener/goshs/security/advisories/GHSA-wvhv-qcqf-f3cx x_refsource_CONFIRM
• https://github.com/patrickhener/goshs/commit/f212c4f4a126556bab008f79758e21a839ef2c0f x_refsource_MISC

Ignored references (1)

• https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4 x_refsource_MISC

---

goshs

• ==< 2.0.0-beta.4

NIXPKGS-2026-1065

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-6069

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  5 packages

  • nasmfmt
  • tree-sitter-grammars.tree-sitter-nasm
  • vimPlugins.nvim-treesitter-parsers.nasm
  • python313Packages.tree-sitter-grammars.tree-sitter-nasm
  • python314Packages.tree-sitter-grammars.tree-sitter-nasm
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

CVE-2026-6069

• https://github.com/netwide-assembler/nasm/issues/217

---

NASM

• ==nasm-3.02rc5

No patch available at the CVE publication

NIXPKGS-2026-1064

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-40198

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass

• https://github.com/stigtsp/Net-CIDR-Lite/commit/25d65f85dbe4885959a10471725ec9d… patch
• https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes release-notes

Ignored references (1)

• https://www.cve.org/CVERecord?id=CVE-2026-40199 related

---

Net-CIDR-Lite

• <0.23

NIXPKGS-2026-1063

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-5188

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Integer underflow in X.509 SAN parsing in wolfSSL

• https://github.com/wolfSSL/wolfssl/pull/10024

---

wolfSSL

• =<5.9.0

NIXPKGS-2026-1062

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-5500

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Improper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication Bypass

• https://github.com/wolfSSL/wolfssl/pull/10102

---

wolfSSL

• =<5.9.0

NIXPKGS-2026-1061

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-5501

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Improper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates

• https://github.com/wolfSSL/wolfssl/pull/10102

---

wolfSSL

• =<5.9.0

NIXPKGS-2026-1060

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-5466

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

wc_VerifyEccsiHash missing sanity check

• https://github.com/wolfssl/wolfssl/pull/10102

---

wolfSSL

• <5.9.1

NIXPKGS-2026-1059

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-6068

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored
  5 packages

  • nasmfmt
  • vimPlugins.nvim-treesitter-parsers.nasm
  • python313Packages.tree-sitter-grammars.tree-sitter-nasm
  • python314Packages.tree-sitter-grammars.tree-sitter-nasm
  • tree-sitter-grammars.tree-sitter-nasm
  2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

CVE-2026-6068

• https://github.com/netwide-assembler/nasm/issues/222

---

NASM

• ==nasm-3.02rc5

No patch available at the CVE publication

NIXPKGS-2026-1058

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35598

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Vikunja has Missing Authorization on CalDAV Task Read

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x x_refsource_CONFIRM
• https://github.com/go-vikunja/vikunja/pull/2579 x_refsource_MISC
• https://github.com/go-vikunja/vikunja/commit/879462d717351fe5d276ddec5246bdec31b41661 x_refsource_MISC

Ignored references (1)

• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC

---

vikunja

• ==< 2.3.0

NIXPKGS-2026-1057

GitHub issue published 2 months, 2 weeks ago

Permalink CVE-2026-35600

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 2 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 2 months, 2 weeks ago
• @LeSuisse ignored package vikunja-desktop 2 months, 2 weeks ago
• @LeSuisse accepted 2 months, 2 weeks ago
• @LeSuisse published on GitHub 2 months, 2 weeks ago

Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-45q4-x4r9-8fqj x_refsource_CONFIRM
• https://github.com/go-vikunja/vikunja/pull/2580 x_refsource_MISC
• https://github.com/go-vikunja/vikunja/commit/0f3730d045f20e261e3cdfc6d93c325653395b64 x_refsource_MISC

Ignored references (1)

• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 x_refsource_MISC

---

vikunja

• ==< 2.3.0