Dismissed suggestions Untriaged suggestions Draft issues Published issues Automatically generated suggestions Create Draft to queue a suggestion for refinement. Dismiss to remove a suggestion from the queue. CVE-2024-25982 4.3 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): NONE User interaction (UI): REQUIRED Scope (S): UNCHANGED Confidentiality impact (C): LOW Integrity impact (I): NONE Availability impact (A): NONE created 4 days, 1 hour ago Msa-24-0005: csrf risk in language import utility The link to update all installed language packs did not include the necessary token to prevent a CSRF risk. moodle <4.1.9 <4.2.6 <4.3.3 pkgs.moodle Free and open-source learning management system (LMS) written in PHP nixos-24.05 4.4 nixpkgs-24.05-darwin 4.4 nixos-24.05-small 4.4 nixos-24.11 4.4.3 nixpkgs-24.11-darwin 4.4.3 nixos-24.11-small 4.4.3 nixos-unstable 4.4.3 nixos-unstable-small 4.4.4 nixpkgs-unstable 4.4.3 pkgs.moodle-dl A Moodle downloader that downloads course content fast from Moodle nixos-24.05 2.2.2.4 nixpkgs-24.05-darwin 2.2.2.4 nixos-24.05-small 2.2.2.4 nixos-24.11 2.3.12 nixpkgs-24.11-darwin 2.3.12 nixos-24.11-small 2.3.12 nixos-unstable 2.3.12 nixos-unstable-small 2.3.12 nixpkgs-unstable 2.3.12 pkgs.texlivePackages.moodle Generating Moodle quizzes via LaTeX nixos-24.05 1.0 nixpkgs-24.05-darwin 1.0 nixos-24.05-small 1.0 Notify package maintainers: 2 @freezeboy freezeboy @kmein Kierán Meinhardt <kmein@posteo.de> CVE-2024-6387 8.1 HIGH CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): HIGH Privileges required (PR): NONE User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): HIGH created 4 days, 1 hour ago Openssh: regresshion - race condition in ssh allows rce/dos A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. rhcos * OpenSSH =<9.7p1 openssh * rhceph-6-rhel9 pkgs.openssh Implementation of the SSH protocol nixos-24.05 9.7p1 nixpkgs-24.05-darwin 9.7p1 nixos-24.05-small 9.7p1 nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.opensshTest Implementation of the SSH protocol nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.openssh_hpn Implementation of the SSH protocol with high performance networking patches nixos-24.05 9.7p1 nixpkgs-24.05-darwin 9.7p1 nixos-24.05-small 9.7p1 nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.openssh_gssapi Implementation of the SSH protocol with GSSAPI support nixos-24.05 9.7p1 nixpkgs-24.05-darwin 9.7p1 nixos-24.05-small 9.7p1 nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.opensshWithKerberos Implementation of the SSH protocol nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.openssh_hpnWithKerberos Implementation of the SSH protocol with high performance networking patches nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.lxqt.lxqt-openssh-askpass GUI to query passwords on behalf of SSH agents nixos-24.05 2.0.1 nixpkgs-24.05-darwin 2.0.1 nixos-24.05-small 2.0.1 nixos-24.11 2.1.0 nixpkgs-24.11-darwin 2.1.0 nixos-24.11-small 2.1.0 nixos-unstable 2.1.0 nixos-unstable-small 2.1.0 nixpkgs-unstable 2.1.0 pkgs.perl536Packages.NetOpenSSH Perl SSH client package implemented on top of OpenSSH nixos-24.05 0.84 nixpkgs-24.05-darwin 0.84 nixos-24.05-small 0.84 pkgs.perl538Packages.NetOpenSSH Perl SSH client package implemented on top of OpenSSH nixos-24.05 0.84 nixpkgs-24.05-darwin 0.84 nixos-24.05-small 0.84 nixos-24.11 0.84 nixpkgs-24.11-darwin 0.84 nixos-24.11-small 0.84 nixos-unstable 0.84 nixos-unstable-small 0.84 nixpkgs-unstable 0.84 pkgs.perl540Packages.NetOpenSSH Perl SSH client package implemented on top of OpenSSH nixos-24.11 0.84 nixpkgs-24.11-darwin 0.84 nixos-24.11-small 0.84 nixos-unstable 0.84 nixos-unstable-small 0.84 nixpkgs-unstable 0.84 Notify package maintainers: 6 @dasJ Janne Heß <janne@hess.ooo> @Conni2461 Simon Hauser <simon.hauser@outlook.com> @helsinki-Jo Joachim Ernst <joachim.ernst@helsinki-systems.de> @wahjava Ashish SHUKLA <ashish.is@lostca.se> @aneeshusa Aneesh Agrawal <aneeshusa@gmail.com> @romildo José Romildo Malaquias <malaquias@gmail.com> CVE-2025-46443 4.9 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): HIGH Privileges required (PR): LOW User interaction (UI): NONE Scope (S): CHANGED Confidentiality impact (C): LOW Integrity impact (I): LOW Availability impact (A): NONE created 4 days, 1 hour ago WordPress Animate <= 0.5 - Server Side Request Forgery (SSRF) Vulnerability Server-Side Request Forgery (SSRF) vulnerability in Adam Pery Animate allows Server Side Request Forgery. This issue affects Animate: from n/a through 0.5. animate =<0.5 pkgs.texlivePackages.animate Create PDF and SVG animations from graphics files and inline graphics nixos-24.05 67401 nixpkgs-24.05-darwin 67401 nixos-24.05-small 67401 pkgs.vimPlugins.mini-animate nixos-24.11 2024-09-06 nixpkgs-24.11-darwin 2024-09-06 nixos-24.11-small 2024-09-06 nixos-unstable 2024-12-01 nixos-unstable-small 2024-12-01 nixpkgs-unstable 2024-12-01 CVE-2025-46505 6.5 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): REQUIRED Scope (S): CHANGED Confidentiality impact (C): LOW Integrity impact (I): LOW Availability impact (A): LOW created 4 days, 1 hour ago WordPress Peekaboo <= 1.1 - Cross Site Scripting (XSS) Vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Peekaboo allows Stored XSS. This issue affects Peekaboo: from n/a through 1.1. peekaboo =<1.1 pkgs.vimPlugins.vim-peekaboo nixos-24.05 2019-12-12 nixpkgs-24.05-darwin 2019-12-12 nixos-24.05-small 2019-12-12 nixos-24.11 2019-12-12 nixpkgs-24.11-darwin 2019-12-12 nixos-24.11-small 2019-12-12 nixos-unstable 2019-12-12 nixos-unstable-small 2019-12-12 nixpkgs-unstable 2019-12-12 CVE-2025-46421 6.8 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): HIGH Privileges required (PR): NONE User interaction (UI): REQUIRED Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 4 days, 1 hour ago Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect. libsoup pkgs.libsoup HTTP client/server library for GNOME nixos-24.05 2.74.3 nixpkgs-24.05-darwin 2.74.3 nixos-24.05-small 2.74.3 nixos-24.11 2.74.3 nixpkgs-24.11-darwin 2.74.3 nixos-24.11-small 2.74.3 pkgs.libsoup_3 HTTP client/server library for GNOME nixos-24.05 3.4.4 nixpkgs-24.05-darwin 3.4.4 nixos-24.05-small 3.4.4 nixos-24.11 3.6.0 nixpkgs-24.11-darwin 3.6.0 nixos-24.11-small 3.6.0 nixos-unstable 3.6.0 nixos-unstable-small 3.6.0 nixpkgs-unstable 3.6.0 pkgs.libsoup_2_4 HTTP client/server library for GNOME nixos-unstable 2.74.3 nixos-unstable-small 2.74.3 nixpkgs-unstable 2.74.3 pkgs.gnome.libsoup HTTP client/server library for GNOME nixos-24.05 2.74.3 pkgs.gnome2.libsoup HTTP client/server library for GNOME nixos-24.05 2.74.3 nixpkgs-24.05-darwin 2.74.3 nixos-24.05-small 2.74.3 nixos-24.11 2.74.3 nixpkgs-24.11-darwin 2.74.3 nixos-24.11-small 2.74.3 pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4" Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4 nixos-24.05 2.4 nixpkgs-24.05-darwin 2.4 nixos-24.05-small 2.4 nixos-24.11 2.4 nixpkgs-24.11-darwin 2.4 nixos-24.11-small 2.4 nixos-unstable 2.4 nixos-unstable-small 2.4 nixpkgs-unstable 2.4 Notify package maintainers: 6 @lovek323 Jason O'Conal <jason@oconal.id.au> @jtojnar Jan Tojnar <jtojnar@gmail.com> @bobby285271 Bobby Rong <rjl931189261@126.com> @7c6f434c Michael Raskin <7c6f434c@mail.ru> @hedning Tor Hedin Brønner <torhedinbronner@gmail.com> @dasj19 Daniel Șerbănescu <daniel@serbanescu.dk> CVE-2025-46399 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 5 days, 1 hour ago fig2dev segmentation fault in genge_itp_spline Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via genge_itp_spline function. fig2dev ==3.2.9a pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9 Notify package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me> CVE-2025-46400 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 5 days, 1 hour ago fig2dev segmentation fault in read_arcobject Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via read_arcobject function. fig2dev ==3.2.9a pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9 Notify package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me> CVE-2025-46397 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 5 days, 1 hour ago fig2dev stack-overflow Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via bezier_spline function. fig2dev ==3.2.9a pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9 Notify package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me> CVE-2025-46398 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 5 days, 1 hour ago fig2dev stack-overflow via read_objects Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via read_objects function. fig2dev ==3.2.9a pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9 Notify package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me> CVE-2024-21885 7.8 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): HIGH created 6 days, 1 hour ago Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments. tigervnc * xorg-server ==1.21.1.7 xorg-x11-server * xorg-x11-server-Xwayland * pkgs.tigervnc Fork of tightVNC, made in cooperation with VirtualGL nixos-24.05 1.13.1 nixpkgs-24.05-darwin 1.13.1 nixos-24.05-small 1.13.1 nixos-24.11 1.14.0 nixpkgs-24.11-darwin 1.14.0 nixos-24.11-small 1.14.0 nixos-unstable 1.14.0 nixos-unstable-small 1.14.0 nixpkgs-unstable 1.14.0 pkgs.xorg.xvfb nixos-24.11 21.1.14 nixpkgs-24.11-darwin 21.1.14 nixos-24.11-small 21.1.14 nixos-unstable 21.1.14 nixos-unstable-small 21.1.14 nixpkgs-unstable 21.1.14 pkgs.xorg.xorgserver nixos-24.05 21.1.14 nixpkgs-24.05-darwin 21.1.14 nixos-24.05-small 21.1.14 nixos-24.11 21.1.14 nixpkgs-24.11-darwin 21.1.14 nixos-24.11-small 21.1.14 nixos-unstable 21.1.14 nixos-unstable-small 21.1.14 nixpkgs-unstable 21.1.14 Notify package maintainers: 1 @viric Lluís Batlle i Rossell <viric@viric.name>
CVE-2024-25982 4.3 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): NONE User interaction (UI): REQUIRED Scope (S): UNCHANGED Confidentiality impact (C): LOW Integrity impact (I): NONE Availability impact (A): NONE created 4 days, 1 hour ago Msa-24-0005: csrf risk in language import utility The link to update all installed language packs did not include the necessary token to prevent a CSRF risk. moodle <4.1.9 <4.2.6 <4.3.3 pkgs.moodle Free and open-source learning management system (LMS) written in PHP nixos-24.05 4.4 nixpkgs-24.05-darwin 4.4 nixos-24.05-small 4.4 nixos-24.11 4.4.3 nixpkgs-24.11-darwin 4.4.3 nixos-24.11-small 4.4.3 nixos-unstable 4.4.3 nixos-unstable-small 4.4.4 nixpkgs-unstable 4.4.3 pkgs.moodle-dl A Moodle downloader that downloads course content fast from Moodle nixos-24.05 2.2.2.4 nixpkgs-24.05-darwin 2.2.2.4 nixos-24.05-small 2.2.2.4 nixos-24.11 2.3.12 nixpkgs-24.11-darwin 2.3.12 nixos-24.11-small 2.3.12 nixos-unstable 2.3.12 nixos-unstable-small 2.3.12 nixpkgs-unstable 2.3.12 pkgs.texlivePackages.moodle Generating Moodle quizzes via LaTeX nixos-24.05 1.0 nixpkgs-24.05-darwin 1.0 nixos-24.05-small 1.0 Notify package maintainers: 2 @freezeboy freezeboy @kmein Kierán Meinhardt <kmein@posteo.de>
pkgs.moodle Free and open-source learning management system (LMS) written in PHP nixos-24.05 4.4 nixpkgs-24.05-darwin 4.4 nixos-24.05-small 4.4 nixos-24.11 4.4.3 nixpkgs-24.11-darwin 4.4.3 nixos-24.11-small 4.4.3 nixos-unstable 4.4.3 nixos-unstable-small 4.4.4 nixpkgs-unstable 4.4.3
pkgs.moodle-dl A Moodle downloader that downloads course content fast from Moodle nixos-24.05 2.2.2.4 nixpkgs-24.05-darwin 2.2.2.4 nixos-24.05-small 2.2.2.4 nixos-24.11 2.3.12 nixpkgs-24.11-darwin 2.3.12 nixos-24.11-small 2.3.12 nixos-unstable 2.3.12 nixos-unstable-small 2.3.12 nixpkgs-unstable 2.3.12
pkgs.texlivePackages.moodle Generating Moodle quizzes via LaTeX nixos-24.05 1.0 nixpkgs-24.05-darwin 1.0 nixos-24.05-small 1.0
CVE-2024-6387 8.1 HIGH CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): HIGH Privileges required (PR): NONE User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): HIGH created 4 days, 1 hour ago Openssh: regresshion - race condition in ssh allows rce/dos A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. rhcos * OpenSSH =<9.7p1 openssh * rhceph-6-rhel9 pkgs.openssh Implementation of the SSH protocol nixos-24.05 9.7p1 nixpkgs-24.05-darwin 9.7p1 nixos-24.05-small 9.7p1 nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.opensshTest Implementation of the SSH protocol nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.openssh_hpn Implementation of the SSH protocol with high performance networking patches nixos-24.05 9.7p1 nixpkgs-24.05-darwin 9.7p1 nixos-24.05-small 9.7p1 nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.openssh_gssapi Implementation of the SSH protocol with GSSAPI support nixos-24.05 9.7p1 nixpkgs-24.05-darwin 9.7p1 nixos-24.05-small 9.7p1 nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.opensshWithKerberos Implementation of the SSH protocol nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.openssh_hpnWithKerberos Implementation of the SSH protocol with high performance networking patches nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1 pkgs.lxqt.lxqt-openssh-askpass GUI to query passwords on behalf of SSH agents nixos-24.05 2.0.1 nixpkgs-24.05-darwin 2.0.1 nixos-24.05-small 2.0.1 nixos-24.11 2.1.0 nixpkgs-24.11-darwin 2.1.0 nixos-24.11-small 2.1.0 nixos-unstable 2.1.0 nixos-unstable-small 2.1.0 nixpkgs-unstable 2.1.0 pkgs.perl536Packages.NetOpenSSH Perl SSH client package implemented on top of OpenSSH nixos-24.05 0.84 nixpkgs-24.05-darwin 0.84 nixos-24.05-small 0.84 pkgs.perl538Packages.NetOpenSSH Perl SSH client package implemented on top of OpenSSH nixos-24.05 0.84 nixpkgs-24.05-darwin 0.84 nixos-24.05-small 0.84 nixos-24.11 0.84 nixpkgs-24.11-darwin 0.84 nixos-24.11-small 0.84 nixos-unstable 0.84 nixos-unstable-small 0.84 nixpkgs-unstable 0.84 pkgs.perl540Packages.NetOpenSSH Perl SSH client package implemented on top of OpenSSH nixos-24.11 0.84 nixpkgs-24.11-darwin 0.84 nixos-24.11-small 0.84 nixos-unstable 0.84 nixos-unstable-small 0.84 nixpkgs-unstable 0.84 Notify package maintainers: 6 @dasJ Janne Heß <janne@hess.ooo> @Conni2461 Simon Hauser <simon.hauser@outlook.com> @helsinki-Jo Joachim Ernst <joachim.ernst@helsinki-systems.de> @wahjava Ashish SHUKLA <ashish.is@lostca.se> @aneeshusa Aneesh Agrawal <aneeshusa@gmail.com> @romildo José Romildo Malaquias <malaquias@gmail.com>
pkgs.openssh Implementation of the SSH protocol nixos-24.05 9.7p1 nixpkgs-24.05-darwin 9.7p1 nixos-24.05-small 9.7p1 nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1
pkgs.opensshTest Implementation of the SSH protocol nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1
pkgs.openssh_hpn Implementation of the SSH protocol with high performance networking patches nixos-24.05 9.7p1 nixpkgs-24.05-darwin 9.7p1 nixos-24.05-small 9.7p1 nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1
pkgs.openssh_gssapi Implementation of the SSH protocol with GSSAPI support nixos-24.05 9.7p1 nixpkgs-24.05-darwin 9.7p1 nixos-24.05-small 9.7p1 nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1
pkgs.opensshWithKerberos Implementation of the SSH protocol nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1
pkgs.openssh_hpnWithKerberos Implementation of the SSH protocol with high performance networking patches nixos-24.11 9.9p1 nixpkgs-24.11-darwin 9.9p1 nixos-24.11-small 9.9p1 nixos-unstable 9.9p1 nixos-unstable-small 9.9p1 nixpkgs-unstable 9.9p1
pkgs.lxqt.lxqt-openssh-askpass GUI to query passwords on behalf of SSH agents nixos-24.05 2.0.1 nixpkgs-24.05-darwin 2.0.1 nixos-24.05-small 2.0.1 nixos-24.11 2.1.0 nixpkgs-24.11-darwin 2.1.0 nixos-24.11-small 2.1.0 nixos-unstable 2.1.0 nixos-unstable-small 2.1.0 nixpkgs-unstable 2.1.0
pkgs.perl536Packages.NetOpenSSH Perl SSH client package implemented on top of OpenSSH nixos-24.05 0.84 nixpkgs-24.05-darwin 0.84 nixos-24.05-small 0.84
pkgs.perl538Packages.NetOpenSSH Perl SSH client package implemented on top of OpenSSH nixos-24.05 0.84 nixpkgs-24.05-darwin 0.84 nixos-24.05-small 0.84 nixos-24.11 0.84 nixpkgs-24.11-darwin 0.84 nixos-24.11-small 0.84 nixos-unstable 0.84 nixos-unstable-small 0.84 nixpkgs-unstable 0.84
pkgs.perl540Packages.NetOpenSSH Perl SSH client package implemented on top of OpenSSH nixos-24.11 0.84 nixpkgs-24.11-darwin 0.84 nixos-24.11-small 0.84 nixos-unstable 0.84 nixos-unstable-small 0.84 nixpkgs-unstable 0.84
CVE-2025-46443 4.9 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): HIGH Privileges required (PR): LOW User interaction (UI): NONE Scope (S): CHANGED Confidentiality impact (C): LOW Integrity impact (I): LOW Availability impact (A): NONE created 4 days, 1 hour ago WordPress Animate <= 0.5 - Server Side Request Forgery (SSRF) Vulnerability Server-Side Request Forgery (SSRF) vulnerability in Adam Pery Animate allows Server Side Request Forgery. This issue affects Animate: from n/a through 0.5. animate =<0.5 pkgs.texlivePackages.animate Create PDF and SVG animations from graphics files and inline graphics nixos-24.05 67401 nixpkgs-24.05-darwin 67401 nixos-24.05-small 67401 pkgs.vimPlugins.mini-animate nixos-24.11 2024-09-06 nixpkgs-24.11-darwin 2024-09-06 nixos-24.11-small 2024-09-06 nixos-unstable 2024-12-01 nixos-unstable-small 2024-12-01 nixpkgs-unstable 2024-12-01
pkgs.texlivePackages.animate Create PDF and SVG animations from graphics files and inline graphics nixos-24.05 67401 nixpkgs-24.05-darwin 67401 nixos-24.05-small 67401
pkgs.vimPlugins.mini-animate nixos-24.11 2024-09-06 nixpkgs-24.11-darwin 2024-09-06 nixos-24.11-small 2024-09-06 nixos-unstable 2024-12-01 nixos-unstable-small 2024-12-01 nixpkgs-unstable 2024-12-01
CVE-2025-46505 6.5 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): REQUIRED Scope (S): CHANGED Confidentiality impact (C): LOW Integrity impact (I): LOW Availability impact (A): LOW created 4 days, 1 hour ago WordPress Peekaboo <= 1.1 - Cross Site Scripting (XSS) Vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Peekaboo allows Stored XSS. This issue affects Peekaboo: from n/a through 1.1. peekaboo =<1.1 pkgs.vimPlugins.vim-peekaboo nixos-24.05 2019-12-12 nixpkgs-24.05-darwin 2019-12-12 nixos-24.05-small 2019-12-12 nixos-24.11 2019-12-12 nixpkgs-24.11-darwin 2019-12-12 nixos-24.11-small 2019-12-12 nixos-unstable 2019-12-12 nixos-unstable-small 2019-12-12 nixpkgs-unstable 2019-12-12
pkgs.vimPlugins.vim-peekaboo nixos-24.05 2019-12-12 nixpkgs-24.05-darwin 2019-12-12 nixos-24.05-small 2019-12-12 nixos-24.11 2019-12-12 nixpkgs-24.11-darwin 2019-12-12 nixos-24.11-small 2019-12-12 nixos-unstable 2019-12-12 nixos-unstable-small 2019-12-12 nixpkgs-unstable 2019-12-12
CVE-2025-46421 6.8 MEDIUM CVSS version: 3.1 Attack vector (AV): NETWORK Attack complexity (AC): HIGH Privileges required (PR): NONE User interaction (UI): REQUIRED Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 4 days, 1 hour ago Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect. libsoup pkgs.libsoup HTTP client/server library for GNOME nixos-24.05 2.74.3 nixpkgs-24.05-darwin 2.74.3 nixos-24.05-small 2.74.3 nixos-24.11 2.74.3 nixpkgs-24.11-darwin 2.74.3 nixos-24.11-small 2.74.3 pkgs.libsoup_3 HTTP client/server library for GNOME nixos-24.05 3.4.4 nixpkgs-24.05-darwin 3.4.4 nixos-24.05-small 3.4.4 nixos-24.11 3.6.0 nixpkgs-24.11-darwin 3.6.0 nixos-24.11-small 3.6.0 nixos-unstable 3.6.0 nixos-unstable-small 3.6.0 nixpkgs-unstable 3.6.0 pkgs.libsoup_2_4 HTTP client/server library for GNOME nixos-unstable 2.74.3 nixos-unstable-small 2.74.3 nixpkgs-unstable 2.74.3 pkgs.gnome.libsoup HTTP client/server library for GNOME nixos-24.05 2.74.3 pkgs.gnome2.libsoup HTTP client/server library for GNOME nixos-24.05 2.74.3 nixpkgs-24.05-darwin 2.74.3 nixos-24.05-small 2.74.3 nixos-24.11 2.74.3 nixpkgs-24.11-darwin 2.74.3 nixos-24.11-small 2.74.3 pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4" Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4 nixos-24.05 2.4 nixpkgs-24.05-darwin 2.4 nixos-24.05-small 2.4 nixos-24.11 2.4 nixpkgs-24.11-darwin 2.4 nixos-24.11-small 2.4 nixos-unstable 2.4 nixos-unstable-small 2.4 nixpkgs-unstable 2.4 Notify package maintainers: 6 @lovek323 Jason O'Conal <jason@oconal.id.au> @jtojnar Jan Tojnar <jtojnar@gmail.com> @bobby285271 Bobby Rong <rjl931189261@126.com> @7c6f434c Michael Raskin <7c6f434c@mail.ru> @hedning Tor Hedin Brønner <torhedinbronner@gmail.com> @dasj19 Daniel Șerbănescu <daniel@serbanescu.dk>
pkgs.libsoup HTTP client/server library for GNOME nixos-24.05 2.74.3 nixpkgs-24.05-darwin 2.74.3 nixos-24.05-small 2.74.3 nixos-24.11 2.74.3 nixpkgs-24.11-darwin 2.74.3 nixos-24.11-small 2.74.3
pkgs.libsoup_3 HTTP client/server library for GNOME nixos-24.05 3.4.4 nixpkgs-24.05-darwin 3.4.4 nixos-24.05-small 3.4.4 nixos-24.11 3.6.0 nixpkgs-24.11-darwin 3.6.0 nixos-24.11-small 3.6.0 nixos-unstable 3.6.0 nixos-unstable-small 3.6.0 nixpkgs-unstable 3.6.0
pkgs.libsoup_2_4 HTTP client/server library for GNOME nixos-unstable 2.74.3 nixos-unstable-small 2.74.3 nixpkgs-unstable 2.74.3
pkgs.gnome2.libsoup HTTP client/server library for GNOME nixos-24.05 2.74.3 nixpkgs-24.05-darwin 2.74.3 nixos-24.05-small 2.74.3 nixos-24.11 2.74.3 nixpkgs-24.11-darwin 2.74.3 nixos-24.11-small 2.74.3
pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4" Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4 nixos-24.05 2.4 nixpkgs-24.05-darwin 2.4 nixos-24.05-small 2.4 nixos-24.11 2.4 nixpkgs-24.11-darwin 2.4 nixos-24.11-small 2.4 nixos-unstable 2.4 nixos-unstable-small 2.4 nixpkgs-unstable 2.4
CVE-2025-46399 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 5 days, 1 hour ago fig2dev segmentation fault in genge_itp_spline Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via genge_itp_spline function. fig2dev ==3.2.9a pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9 Notify package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me>
pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9
CVE-2025-46400 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 5 days, 1 hour ago fig2dev segmentation fault in read_arcobject Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via read_arcobject function. fig2dev ==3.2.9a pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9 Notify package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me>
pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9
CVE-2025-46397 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 5 days, 1 hour ago fig2dev stack-overflow Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via bezier_spline function. fig2dev ==3.2.9a pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9 Notify package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me>
pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9
CVE-2025-46398 7.1 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): NONE created 5 days, 1 hour ago fig2dev stack-overflow via read_objects Stack-overflow in fig2dev in version 3.2.9a allows an attacker possible code execution via local input manipulation via read_objects function. fig2dev ==3.2.9a pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9 Notify package maintainers: 1 @LeSuisse Thomas Gerbet <thomas@gerbet.me>
pkgs.fig2dev Tool to convert Xfig files to other formats nixos-24.05 3.2.9 nixpkgs-24.05-darwin 3.2.9 nixos-24.05-small 3.2.9 nixos-24.11 3.2.9 nixpkgs-24.11-darwin 3.2.9 nixos-24.11-small 3.2.9 nixos-unstable 3.2.9 nixos-unstable-small 3.2.9 nixpkgs-unstable 3.2.9
CVE-2024-21885 7.8 HIGH CVSS version: 3.1 Attack vector (AV): LOCAL Attack complexity (AC): LOW Privileges required (PR): LOW User interaction (UI): NONE Scope (S): UNCHANGED Confidentiality impact (C): HIGH Integrity impact (I): HIGH Availability impact (A): HIGH created 6 days, 1 hour ago Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments. tigervnc * xorg-server ==1.21.1.7 xorg-x11-server * xorg-x11-server-Xwayland * pkgs.tigervnc Fork of tightVNC, made in cooperation with VirtualGL nixos-24.05 1.13.1 nixpkgs-24.05-darwin 1.13.1 nixos-24.05-small 1.13.1 nixos-24.11 1.14.0 nixpkgs-24.11-darwin 1.14.0 nixos-24.11-small 1.14.0 nixos-unstable 1.14.0 nixos-unstable-small 1.14.0 nixpkgs-unstable 1.14.0 pkgs.xorg.xvfb nixos-24.11 21.1.14 nixpkgs-24.11-darwin 21.1.14 nixos-24.11-small 21.1.14 nixos-unstable 21.1.14 nixos-unstable-small 21.1.14 nixpkgs-unstable 21.1.14 pkgs.xorg.xorgserver nixos-24.05 21.1.14 nixpkgs-24.05-darwin 21.1.14 nixos-24.05-small 21.1.14 nixos-24.11 21.1.14 nixpkgs-24.11-darwin 21.1.14 nixos-24.11-small 21.1.14 nixos-unstable 21.1.14 nixos-unstable-small 21.1.14 nixpkgs-unstable 21.1.14 Notify package maintainers: 1 @viric Lluís Batlle i Rossell <viric@viric.name>
pkgs.tigervnc Fork of tightVNC, made in cooperation with VirtualGL nixos-24.05 1.13.1 nixpkgs-24.05-darwin 1.13.1 nixos-24.05-small 1.13.1 nixos-24.11 1.14.0 nixpkgs-24.11-darwin 1.14.0 nixos-24.11-small 1.14.0 nixos-unstable 1.14.0 nixos-unstable-small 1.14.0 nixpkgs-unstable 1.14.0
pkgs.xorg.xvfb nixos-24.11 21.1.14 nixpkgs-24.11-darwin 21.1.14 nixos-24.11-small 21.1.14 nixos-unstable 21.1.14 nixos-unstable-small 21.1.14 nixpkgs-unstable 21.1.14
pkgs.xorg.xorgserver nixos-24.05 21.1.14 nixpkgs-24.05-darwin 21.1.14 nixos-24.05-small 21.1.14 nixos-24.11 21.1.14 nixpkgs-24.11-darwin 21.1.14 nixos-24.11-small 21.1.14 nixos-unstable 21.1.14 nixos-unstable-small 21.1.14 nixpkgs-unstable 21.1.14