Dismissed suggestions Untriaged suggestions Draft issues Published issues Automatically generated suggestions Create Draft to queue a suggestion for refinement. Dismiss to remove a suggestion from the queue. CVE-2025-3628 4.3 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): LOW Integrity impact (I): NONE Availability impact (A): NONE created 2 months ago Moodle: moodle assignment submission search leaks anonymous student identities A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. moodle <4.5.4 pkgs.moodle Free and open-source learning management system (LMS) written in PHP nixos-unstable ??? nixpkgs-unstable 5.0.2 pkgs.moodle-dl Moodle downloader that downloads course content fast from Moodle nixos-unstable ??? nixpkgs-unstable 2.3.13 Package maintainers: 2 @freezeboy freezeboy @kmein Kierán Meinhardt <kmein@posteo.de> CVE-2025-46421 6.8 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): HIGH Privileges required (PR): NONE User interaction (UI): REQUIRED Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 2 months ago Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect. libsoup <3.6.5 * libsoup3 * pkgs.libsoup_3 HTTP client/server library for GNOME nixos-unstable ??? nixpkgs-unstable 3.6.5 pkgs.libsoup_2_4 HTTP client/server library for GNOME nixos-unstable ??? nixpkgs-unstable 2.74.3 pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4" Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4 nixos-unstable ??? nixpkgs-unstable Package maintainers: 6 @dasj19 Daniel Șerbănescu <daniel@serbanescu.dk> @bobby285271 Bobby Rong <rjl931189261@126.com> @lovek323 Jason O'Conal <jason@oconal.id.au> @7c6f434c Michael Raskin <7c6f434c@mail.ru> @jtojnar Jan Tojnar <jtojnar@gmail.com> @hedning Tor Hedin Brønner <torhedinbronner@gmail.com> CVE-2025-46420 6.5 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): NONE User interaction (UI): REQUIRED Scope (S): UNCHANGED Confidentiality impact (C): NONE Integrity impact (I): NONE Availability impact (A): HIGH created 2 months ago CISA ADP Vulnrichment None libsoup <3.6.3 * libsoup3 pkgs.libsoup_3 HTTP client/server library for GNOME nixos-unstable ??? nixpkgs-unstable 3.6.5 pkgs.libsoup_2_4 HTTP client/server library for GNOME nixos-unstable ??? nixpkgs-unstable 2.74.3 pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4" Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4 nixos-unstable ??? nixpkgs-unstable Package maintainers: 6 @dasj19 Daniel Șerbănescu <daniel@serbanescu.dk> @bobby285271 Bobby Rong <rjl931189261@126.com> @lovek323 Jason O'Conal <jason@oconal.id.au> @7c6f434c Michael Raskin <7c6f434c@mail.ru> @jtojnar Jan Tojnar <jtojnar@gmail.com> @hedning Tor Hedin Brønner <torhedinbronner@gmail.com> CVE-2025-46483 6.5 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): REQUIRED Scope (S): CHANGED Confidentiality impact (C): LOW Integrity impact (I): LOW Availability impact (A): LOW created 2 months ago WordPress Peadig’s Google +1 Button <= 0.1.2 - Cross Site Scripting (XSS) Vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Peadig’s Google +1 Button allows DOM-Based XSS. This issue affects Peadig’s Google +1 Button: from n/a through 0.1.2. google-1 =<0.1.2 pkgs.python312Packages.cirq-google Framework for creating, editing, and invoking Noisy Intermediate Scale Quantum (NISQ) circuits nixos-unstable ??? nixpkgs-unstable 1.6.0 pkgs.python313Packages.cirq-google Framework for creating, editing, and invoking Noisy Intermediate Scale Quantum (NISQ) circuits nixos-unstable ??? nixpkgs-unstable 1.6.0 Package maintainers: 2 @fabaff Fabian Affolter <mail@fabian-affolter.ch> @drewrisinger Drew Risinger <drisinger+nixpkgs@gmail.com> CVE-2025-46400 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 2 months ago None None xfig =<3.2.9a fig2dev ==3.2.9a transfig pkgs.fig2dev Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a pkgs.transfig Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a Package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me> CVE-2025-46399 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 2 months ago fig2dev segmentation fault in genge_itp_spline Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via genge_itp_spline function. xfig =<3.2.9a fig2dev ==3.2.9a transfig pkgs.fig2dev Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a pkgs.transfig Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a Package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me> CVE-2025-46397 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 2 months ago fig2dev stack-overflow Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via bezier_spline function. xfig =<3.2.9a fig2dev ==3.2.9a transfig pkgs.fig2dev Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a pkgs.transfig Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a Package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me> CVE-2025-46398 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 2 months ago fig2dev stack-overflow via read_objects Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via read_objects function. xfig =<3.2.9a fig2dev ==3.2.9a transfig pkgs.fig2dev Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a pkgs.transfig Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a Package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me> CVE-2025-39580 5.8 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): NONE User interaction (UI): NONE Scope (S): CHANGED Confidentiality impact (C): LOW Integrity impact (I): NONE Availability impact (A): NONE created 2 months ago WordPress Dashi <= 3.1.8 - Broken Access Control Vulnerability Missing Authorization vulnerability in jidaikobo Dashi allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dashi: from n/a through 3.1.8. dashi =<3.1.8 pkgs.dashing Dash Generator Script for Any HTML nixos-unstable ??? nixpkgs-unstable 0.4.0 pkgs.python312Packages.dashing Terminal dashboards for Python nixos-unstable ??? nixpkgs-unstable 0.1.0 pkgs.python313Packages.dashing Terminal dashboards for Python nixos-unstable ??? nixpkgs-unstable 0.1.0 pkgs.typstPackages.dashing-dept-news_0_1_0 Share the news with bold graphic design and a modern layout nixos-unstable ??? nixpkgs-unstable 0.1.0 pkgs.typstPackages.dashing-dept-news_0_1_1 Share the news with bold graphic design and a modern layout nixos-unstable ??? nixpkgs-unstable 0.1.1 Package maintainers: 2 @juliusrickert Julius Rickert <nixpkgs@juliusrickert.de> @cherrypiejam Gongqi Huang CVE-2025-24655 7.1 HIGH CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): NONE User interaction (UI): REQUIRED Scope (S): CHANGED Confidentiality impact (C): LOW Integrity impact (I): LOW Availability impact (A): LOW created 2 months ago WordPress Wishlist Plugin <= 1.0.39 - Reflected Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist allows Reflected XSS. This issue affects Wishlist: from n/a through 1.0.39. wishlist =<1.0.39 pkgs.wishlist Single entrypoint for multiple SSH endpoints nixos-unstable ??? nixpkgs-unstable 0.15.2 Package maintainers: 2 @caarlos0 Carlos A Becker <carlos@becker.software> @penguwin Nicolas Martin <penguwin@penguwin.eu>
CVE-2025-3628 4.3 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): LOW Integrity impact (I): NONE Availability impact (A): NONE created 2 months ago Moodle: moodle assignment submission search leaks anonymous student identities A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities. moodle <4.5.4 pkgs.moodle Free and open-source learning management system (LMS) written in PHP nixos-unstable ??? nixpkgs-unstable 5.0.2 pkgs.moodle-dl Moodle downloader that downloads course content fast from Moodle nixos-unstable ??? nixpkgs-unstable 2.3.13 Package maintainers: 2 @freezeboy freezeboy @kmein Kierán Meinhardt <kmein@posteo.de>
pkgs.moodle Free and open-source learning management system (LMS) written in PHP nixos-unstable ??? nixpkgs-unstable 5.0.2
pkgs.moodle-dl Moodle downloader that downloads course content fast from Moodle nixos-unstable ??? nixpkgs-unstable 2.3.13
CVE-2025-46421 6.8 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): HIGH Privileges required (PR): NONE User interaction (UI): REQUIRED Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 2 months ago Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect. libsoup <3.6.5 * libsoup3 * pkgs.libsoup_3 HTTP client/server library for GNOME nixos-unstable ??? nixpkgs-unstable 3.6.5 pkgs.libsoup_2_4 HTTP client/server library for GNOME nixos-unstable ??? nixpkgs-unstable 2.74.3 pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4" Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4 nixos-unstable ??? nixpkgs-unstable Package maintainers: 6 @dasj19 Daniel Șerbănescu <daniel@serbanescu.dk> @bobby285271 Bobby Rong <rjl931189261@126.com> @lovek323 Jason O'Conal <jason@oconal.id.au> @7c6f434c Michael Raskin <7c6f434c@mail.ru> @jtojnar Jan Tojnar <jtojnar@gmail.com> @hedning Tor Hedin Brønner <torhedinbronner@gmail.com>
pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4" Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4 nixos-unstable ??? nixpkgs-unstable
CVE-2025-46420 6.5 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): NONE User interaction (UI): REQUIRED Scope (S): UNCHANGED Confidentiality impact (C): NONE Integrity impact (I): NONE Availability impact (A): HIGH created 2 months ago CISA ADP Vulnrichment None libsoup <3.6.3 * libsoup3 pkgs.libsoup_3 HTTP client/server library for GNOME nixos-unstable ??? nixpkgs-unstable 3.6.5 pkgs.libsoup_2_4 HTTP client/server library for GNOME nixos-unstable ??? nixpkgs-unstable 2.74.3 pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4" Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4 nixos-unstable ??? nixpkgs-unstable Package maintainers: 6 @dasj19 Daniel Șerbănescu <daniel@serbanescu.dk> @bobby285271 Bobby Rong <rjl931189261@126.com> @lovek323 Jason O'Conal <jason@oconal.id.au> @7c6f434c Michael Raskin <7c6f434c@mail.ru> @jtojnar Jan Tojnar <jtojnar@gmail.com> @hedning Tor Hedin Brønner <torhedinbronner@gmail.com>
pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4" Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4 nixos-unstable ??? nixpkgs-unstable
CVE-2025-46483 6.5 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): REQUIRED Scope (S): CHANGED Confidentiality impact (C): LOW Integrity impact (I): LOW Availability impact (A): LOW created 2 months ago WordPress Peadig’s Google +1 Button <= 0.1.2 - Cross Site Scripting (XSS) Vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Peadig’s Google +1 Button allows DOM-Based XSS. This issue affects Peadig’s Google +1 Button: from n/a through 0.1.2. google-1 =<0.1.2 pkgs.python312Packages.cirq-google Framework for creating, editing, and invoking Noisy Intermediate Scale Quantum (NISQ) circuits nixos-unstable ??? nixpkgs-unstable 1.6.0 pkgs.python313Packages.cirq-google Framework for creating, editing, and invoking Noisy Intermediate Scale Quantum (NISQ) circuits nixos-unstable ??? nixpkgs-unstable 1.6.0 Package maintainers: 2 @fabaff Fabian Affolter <mail@fabian-affolter.ch> @drewrisinger Drew Risinger <drisinger+nixpkgs@gmail.com>
pkgs.python312Packages.cirq-google Framework for creating, editing, and invoking Noisy Intermediate Scale Quantum (NISQ) circuits nixos-unstable ??? nixpkgs-unstable 1.6.0
pkgs.python313Packages.cirq-google Framework for creating, editing, and invoking Noisy Intermediate Scale Quantum (NISQ) circuits nixos-unstable ??? nixpkgs-unstable 1.6.0
CVE-2025-46400 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 2 months ago None None xfig =<3.2.9a fig2dev ==3.2.9a transfig pkgs.fig2dev Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a pkgs.transfig Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a Package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me>
CVE-2025-46399 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 2 months ago fig2dev segmentation fault in genge_itp_spline Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via genge_itp_spline function. xfig =<3.2.9a fig2dev ==3.2.9a transfig pkgs.fig2dev Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a pkgs.transfig Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a Package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me>
CVE-2025-46397 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 2 months ago fig2dev stack-overflow Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via bezier_spline function. xfig =<3.2.9a fig2dev ==3.2.9a transfig pkgs.fig2dev Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a pkgs.transfig Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a Package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me>
CVE-2025-46398 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 2 months ago fig2dev stack-overflow via read_objects Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via read_objects function. xfig =<3.2.9a fig2dev ==3.2.9a transfig pkgs.fig2dev Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a pkgs.transfig Tool to convert Xfig files to other formats nixos-unstable ??? nixpkgs-unstable 3.2.9a Package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me>
CVE-2025-39580 5.8 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): NONE User interaction (UI): NONE Scope (S): CHANGED Confidentiality impact (C): LOW Integrity impact (I): NONE Availability impact (A): NONE created 2 months ago WordPress Dashi <= 3.1.8 - Broken Access Control Vulnerability Missing Authorization vulnerability in jidaikobo Dashi allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dashi: from n/a through 3.1.8. dashi =<3.1.8 pkgs.dashing Dash Generator Script for Any HTML nixos-unstable ??? nixpkgs-unstable 0.4.0 pkgs.python312Packages.dashing Terminal dashboards for Python nixos-unstable ??? nixpkgs-unstable 0.1.0 pkgs.python313Packages.dashing Terminal dashboards for Python nixos-unstable ??? nixpkgs-unstable 0.1.0 pkgs.typstPackages.dashing-dept-news_0_1_0 Share the news with bold graphic design and a modern layout nixos-unstable ??? nixpkgs-unstable 0.1.0 pkgs.typstPackages.dashing-dept-news_0_1_1 Share the news with bold graphic design and a modern layout nixos-unstable ??? nixpkgs-unstable 0.1.1 Package maintainers: 2 @juliusrickert Julius Rickert <nixpkgs@juliusrickert.de> @cherrypiejam Gongqi Huang
pkgs.python312Packages.dashing Terminal dashboards for Python nixos-unstable ??? nixpkgs-unstable 0.1.0
pkgs.python313Packages.dashing Terminal dashboards for Python nixos-unstable ??? nixpkgs-unstable 0.1.0
pkgs.typstPackages.dashing-dept-news_0_1_0 Share the news with bold graphic design and a modern layout nixos-unstable ??? nixpkgs-unstable 0.1.0
pkgs.typstPackages.dashing-dept-news_0_1_1 Share the news with bold graphic design and a modern layout nixos-unstable ??? nixpkgs-unstable 0.1.1
CVE-2025-24655 7.1 HIGH CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): NONE User interaction (UI): REQUIRED Scope (S): CHANGED Confidentiality impact (C): LOW Integrity impact (I): LOW Availability impact (A): LOW created 2 months ago WordPress Wishlist Plugin <= 1.0.39 - Reflected Cross Site Scripting (XSS) vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist allows Reflected XSS. This issue affects Wishlist: from n/a through 1.0.39. wishlist =<1.0.39 pkgs.wishlist Single entrypoint for multiple SSH endpoints nixos-unstable ??? nixpkgs-unstable 0.15.2 Package maintainers: 2 @caarlos0 Carlos A Becker <carlos@becker.software> @penguwin Nicolas Martin <penguwin@penguwin.eu>
pkgs.wishlist Single entrypoint for multiple SSH endpoints nixos-unstable ??? nixpkgs-unstable 0.15.2