⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Automatically generated suggestions

Create Draft to queue a suggestion for refinement.

Dismiss to remove a suggestion from the queue.

CVE-2025-49075
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 3 weeks ago by @06kellyjac Activity log
  • Created automatic suggestion 3 weeks, 5 days ago
  • @06kellyjac accepted as draft 3 weeks ago
  • @06kellyjac marked as untriaged 3 weeks ago
WordPress Wishlist plugin <= 1.0.43 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist allows Stored XSS.This issue affects Wishlist: from n/a through 1.0.43.

wishlist
=<1.0.43

pkgs.wishlist.x86_64-linux

Single entrypoint for multiple SSH endpoints

pkgs.wishlist.aarch64-linux

Single entrypoint for multiple SSH endpoints

pkgs.wishlist.x86_64-darwin

Single entrypoint for multiple SSH endpoints

pkgs.wishlist.aarch64-darwin

Single entrypoint for multiple SSH endpoints
Notify package maintainers: 2
CVE-2025-31638
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 3 weeks, 2 days ago
WordPress Spare <= 1.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeton Spare allows Reflected XSS. This issue affects Spare: from n/a through 1.7.

spare
=<1.7

pkgs.asciiquarium-transparent

Aquarium/sea animation in ASCII art (with option of transparent background)

pkgs.texlivePackages.transparent

Using a color stack for transparency with pdfTeX

pkgs.texlivePackages.transparent-io

Show for approval the filenames used in input, openin, or openout

pkgs.gnomeExtensions.transparent-topbar

Transparent Topbar with Multi monitors support
  • nixos-24.05 4
    • nixos-24.05-small 4

pkgs.gnomeExtensions.transparent-top-bar

Bring back the transparent top bar when free-floating in GNOME Shell 3.32.

pkgs.asciiquarium-transparent.x86_64-linux

Aquarium/sea animation in ASCII art (with option of transparent background)

pkgs.asciiquarium-transparent.aarch64-linux

Aquarium/sea animation in ASCII art (with option of transparent background)

pkgs.asciiquarium-transparent.x86_64-darwin

Aquarium/sea animation in ASCII art (with option of transparent background)

pkgs.asciiquarium-transparent.aarch64-darwin

Aquarium/sea animation in ASCII art (with option of transparent background)

pkgs.texlivePackages.transparent.x86_64-linux

Using a color stack for transparency with pdfTeX

pkgs.gnomeExtensions.transparent-window-moving

Makes the window semi-transparent when moving or resizing

pkgs.texlivePackages.transparent-io.x86_64-linux

Show for approval the filenames used in input, openin, or openout

pkgs.gnomeExtensions.transparent-topbar.x86_64-linux

Transparent Topbar with Multi monitors support
  • nixos-24.05 4
    • nixpkgs-24.05-darwin 4

pkgs.gnomeExtensions.transparent-top-bar.x86_64-linux

Bring back the transparent top bar when free-floating in GNOME Shell 3.32.

pkgs.gnomeExtensions.transparent-topbar.aarch64-linux

Transparent Topbar with Multi monitors support
  • nixos-24.05 4
    • nixpkgs-24.05-darwin 4

pkgs.gnomeExtensions.transparent-top-bar.aarch64-linux

Bring back the transparent top bar when free-floating in GNOME Shell 3.32.

pkgs.gnomeExtensions.transparent-window-moving.x86_64-linux

Makes the window semi-transparent when moving or resizing

pkgs.gnomeExtensions.transparent-window-moving.aarch64-linux

Makes the window semi-transparent when moving or resizing

pkgs.gnomeExtensions.transparent-top-bar-adjustable-transparency

Fork of: https://github.com/zhanghai/gnome-shell-extension-transparent-top-bar

pkgs.gnomeExtensions.transparent-top-bar-adjustable-transparency.x86_64-linux

Fork of: https://github.com/zhanghai/gnome-shell-extension-transparent-top-bar

pkgs.gnomeExtensions.transparent-top-bar-adjustable-transparency.aarch64-linux

Fork of: https://github.com/zhanghai/gnome-shell-extension-transparent-top-bar
Notify package maintainers: 4
CVE-2025-28945
8.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 3 weeks, 2 days ago
WordPress Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Valen - Sport, Fashion WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects Valen - Sport, Fashion WooCommerce WordPress Theme: from n/a through 2.4.

valen
=<2.4

pkgs.haskellPackages.equivalence

Maintaining an equivalence relation implemented as union-find using STT

pkgs.haskellPackages.equivalence.x86_64-linux

Maintaining an equivalence relation implemented as union-find using STT

pkgs.haskellPackages.equivalence.aarch64-linux

Maintaining an equivalence relation implemented as union-find using STT

pkgs.haskellPackages.equivalence.x86_64-darwin

Maintaining an equivalence relation implemented as union-find using STT

pkgs.haskellPackages.equivalence.aarch64-darwin

Maintaining an equivalence relation implemented as union-find using STT

pkgs.vscode-extensions.valentjn.vscode-ltex.aarch64-linux

pkgs.vscode-extensions.valentjn.vscode-ltex.x86_64-darwin

pkgs.vscode-extensions.valentjn.vscode-ltex.aarch64-darwin

Notify package maintainers: 7
CVE-2025-31396
9.8 CRITICAL
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 3 weeks, 2 days ago
WordPress FLAP - Business WordPress Theme <= 1.5 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. This issue affects FLAP - Business WordPress Theme: from n/a through 1.5.

flap
=<1.5

pkgs.jflap

GUI tool for experimenting with formal languages topics

pkgs.jflap.x86_64-linux

GUI tool for experimenting with formal languages topics

pkgs.jflap.aarch64-linux

GUI tool for experimenting with formal languages topics
Notify package maintainers: 2
CVE-2025-32291
10.0 CRITICAL
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 3 weeks, 2 days ago
WordPress SUMO Affiliates Pro <= 10.7.0 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro allows Using Malicious Files. This issue affects SUMO Affiliates Pro: from n/a through 10.7.0.

affs
=<10.7.0

pkgs.unyaffs

Tool to extract files from a YAFFS2 file system image

pkgs.unyaffs.x86_64-linux

Tool to extract files from a YAFFS2 file system image

pkgs.unyaffs.aarch64-linux

Tool to extract files from a YAFFS2 file system image

pkgs.unyaffs.x86_64-darwin

Tool to extract files from a YAFFS2 file system image

pkgs.unyaffs.aarch64-darwin

Tool to extract files from a YAFFS2 file system image
Notify package maintainers: 2
CVE-2025-47711
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
created 3 weeks, 2 days ago
Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service

There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.

nbdkit
virt:av/nbdkit
virt:8.2/nbdkit
virt:rhel/nbdkit

pkgs.nbdkit.x86_64-linux

NBD server with stable plugin ABI and permissive license

pkgs.nbdkit.aarch64-linux

NBD server with stable plugin ABI and permissive license
Notify package maintainers: 1
CVE-2025-31061
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 3 weeks, 2 days ago
WordPress Wishlist plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Wishlist allows Reflected XSS. This issue affects Wishlist: from n/a through 2.1.0.

wishlist
=<2.1.0

pkgs.wishlist.x86_64-linux

Single entrypoint for multiple SSH endpoints

pkgs.wishlist.aarch64-linux

Single entrypoint for multiple SSH endpoints

pkgs.wishlist.x86_64-darwin

Single entrypoint for multiple SSH endpoints

pkgs.wishlist.aarch64-darwin

Single entrypoint for multiple SSH endpoints
Notify package maintainers: 2
CVE-2025-47712
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
created 3 weeks, 2 days ago
Nbd: nbdkit: integer overflow triggers an assertion resulting in denial of service

A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service.

nbdkit
virt:av/nbdkit
virt:8.2/nbdkit
virt:rhel/nbdkit

pkgs.nbdkit.x86_64-linux

NBD server with stable plugin ABI and permissive license

pkgs.nbdkit.aarch64-linux

NBD server with stable plugin ABI and permissive license
Notify package maintainers: 1
CVE-2025-0620
6.6 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 3 weeks, 5 days ago
Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session

A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.

rhcos
samba
<4.21.6
samba4

pkgs.samba

Standard Windows interoperability suite of programs for Linux and Unix

pkgs.samba.x86_64-linux

Standard Windows interoperability suite of programs for Linux and Unix

pkgs.samba.aarch64-linux

Standard Windows interoperability suite of programs for Linux and Unix

pkgs.samba.x86_64-darwin

Standard Windows interoperability suite of programs for Linux and Unix

pkgs.samba4.x86_64-linux

The standard Windows interoperability suite of programs for Linux and Unix

pkgs.samba.aarch64-darwin

Standard Windows interoperability suite of programs for Linux and Unix

pkgs.samba4.aarch64-linux

The standard Windows interoperability suite of programs for Linux and Unix

pkgs.samba4.x86_64-darwin

The standard Windows interoperability suite of programs for Linux and Unix

pkgs.samba4.aarch64-darwin

The standard Windows interoperability suite of programs for Linux and Unix

pkgs.sambaFull.x86_64-linux

The standard Windows interoperability suite of programs for Linux and Unix

pkgs.sambaFull.aarch64-linux

The standard Windows interoperability suite of programs for Linux and Unix

pkgs.sambaFull.x86_64-darwin

The standard Windows interoperability suite of programs for Linux and Unix

pkgs.samba4Full.aarch64-linux

The standard Windows interoperability suite of programs for Linux and Unix

pkgs.samba4Full.x86_64-darwin

The standard Windows interoperability suite of programs for Linux and Unix

pkgs.sambaFull.aarch64-darwin

The standard Windows interoperability suite of programs for Linux and Unix

pkgs.samba4Full.aarch64-darwin

The standard Windows interoperability suite of programs for Linux and Unix
Notify package maintainers: 2
CVE-2025-49241
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 3 weeks, 5 days ago
WordPress oik <= 4.15.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in bobbingwide oik allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects oik: from n/a through 4.15.1.

oik
=<4.15.1

pkgs.libvoikko.x86_64-linux

Finnish language processing library

pkgs.libvoikko.aarch64-linux

Finnish language processing library

pkgs.libvoikko.x86_64-darwin

Finnish language processing library

pkgs.libvoikko.aarch64-darwin

Finnish language processing library
Notify package maintainers: 1