⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Automatically generated suggestions

Create Draft to queue a suggestion for refinement.

Dismiss to remove a suggestion from the queue.

CVE-2023-3758
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): ADJACENT_NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months, 3 weeks ago
Sssd: race condition during authorization leads to gpo policies functioning inconsistently

A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.

sssd
<2.9.5
*

pkgs.sssd

System Security Services Daemon
Package maintainers: 1
CVE-2022-2084
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 6 months, 3 weeks ago
sensitive data exposure in cloud-init logs

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.

cloud-init
<23.0

pkgs.cloud-init

Provides configuration and customization of cloud instance
Package maintainers: 2
CVE-2023-30797
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 6 months, 3 weeks ago
Insecure Random Generation in Netflix Lemur

Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.

lemur
<<1.3.2

pkgs.lemurs

Customizable TUI display/login manager written in Rust
Package maintainers: 1
CVE-2021-3429
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 6 months, 3 weeks ago
sensitive data exposure in cloud-init logs

When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.

cloud-init
<21.2

pkgs.cloud-init

Provides configuration and customization of cloud instance
Package maintainers: 2
CVE-2023-30798
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months, 3 weeks ago
MultipartParser DOS with too many fields or files in Starlette Framework

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.

starlette
<0.25.0

pkgs.python311Packages.starlette

Little ASGI framework that shines

pkgs.python312Packages.starlette

Little ASGI framework that shines

pkgs.python311Packages.sse-starlette

Server Sent Events for Starlette and FastAPI

pkgs.python311Packages.starlette-wtf

Simple tool for integrating Starlette and WTForms

pkgs.python312Packages.sse-starlette

Server Sent Events for Starlette and FastAPI

pkgs.python312Packages.starlette-wtf

Simple tool for integrating Starlette and WTForms

pkgs.python311Packages.starlette-admin

Fast, beautiful and extensible administrative interface framework for Starlette & FastApi applications

pkgs.python312Packages.starlette-admin

Fast, beautiful and extensible administrative interface framework for Starlette & FastApi applications

pkgs.python311Packages.starlette-context

Middleware for Starlette that allows you to store and access the context data of a request

pkgs.python312Packages.starlette-context

Middleware for Starlette that allows you to store and access the context data of a request

pkgs.python312Packages.starlette.x86_64-linux

Little ASGI framework that shines

pkgs.python312Packages.starlette.aarch64-linux

Little ASGI framework that shines

pkgs.python312Packages.starlette.x86_64-darwin

Little ASGI framework that shines

pkgs.python312Packages.starlette.aarch64-darwin

Little ASGI framework that shines

pkgs.python312Packages.sse-starlette.x86_64-linux

Server Sent Events for Starlette and FastAPI

pkgs.python312Packages.starlette-wtf.x86_64-linux

Simple tool for integrating Starlette and WTForms

pkgs.python312Packages.sse-starlette.aarch64-linux

Server Sent Events for Starlette and FastAPI

pkgs.python312Packages.sse-starlette.x86_64-darwin

Server Sent Events for Starlette and FastAPI

pkgs.python312Packages.starlette-wtf.aarch64-linux

Simple tool for integrating Starlette and WTForms

pkgs.python312Packages.starlette-wtf.x86_64-darwin

Simple tool for integrating Starlette and WTForms

pkgs.python312Packages.sse-starlette.aarch64-darwin

Server Sent Events for Starlette and FastAPI

pkgs.python312Packages.starlette-admin.x86_64-linux

Fast, beautiful and extensible administrative interface framework for Starlette & FastApi applications

pkgs.python312Packages.starlette-wtf.aarch64-darwin

Simple tool for integrating Starlette and WTForms

pkgs.python312Packages.starlette-admin.aarch64-linux

Fast, beautiful and extensible administrative interface framework for Starlette & FastApi applications

pkgs.python312Packages.starlette-admin.x86_64-darwin

Fast, beautiful and extensible administrative interface framework for Starlette & FastApi applications

pkgs.python312Packages.starlette-admin.aarch64-darwin

Fast, beautiful and extensible administrative interface framework for Starlette & FastApi applications

pkgs.python312Packages.starlette-context.x86_64-linux

Middleware for Starlette that allows you to store and access the context data of a request

pkgs.python312Packages.starlette-context.aarch64-linux

Middleware for Starlette that allows you to store and access the context data of a request

pkgs.python312Packages.starlette-context.x86_64-darwin

Middleware for Starlette that allows you to store and access the context data of a request

pkgs.python312Packages.starlette-context.aarch64-darwin

Middleware for Starlette that allows you to store and access the context data of a request
Package maintainers: 7
CVE-2025-22696
5.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months, 3 weeks ago
WordPress Document Block – Upload & Embed Docs, PDF, PPT, XLS or Any Documents plugin <= 1.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in EmbedPress Document Block – Upload & Embed Docs. This issue affects Document Block – Upload & Embed Docs: from n/a through 1.1.0.

document
=<1.1.0

pkgs.phpdocumentor

PHP documentation generator

pkgs.documentation-highlighter

Highlight.js sources for the Nix Ecosystem's documentation
  • nixos-unstable ???
    • nixos-unstable-small
    • nixpkgs-unstable

pkgs.onlyoffice-documentserver

ONLYOFFICE Document Server is an online office suite comprising viewers and editors

pkgs.phpdocumentor.x86_64-linux

PHP documentation generator

pkgs.phpdocumentor.aarch64-linux

PHP documentation generator

pkgs.phpdocumentor.x86_64-darwin

PHP documentation generator

pkgs.libsForQt5.mauikit-documents

MauiKit QtQuick plugins for text editing

pkgs.phpdocumentor.aarch64-darwin

PHP documentation generator

pkgs.kdePackages.libkeduvocdocument

Library to parse, convert, and manipulate KVTML files

pkgs.python311Packages.pydocumentdb

Azure Cosmos DB API

pkgs.python312Packages.pydocumentdb

Azure Cosmos DB API

pkgs.cudaPackages.cuda_documentation

CUDA Documentation. By downloading and using the packages you accept the terms and conditions of the CUDA EULA

pkgs.plasma5Packages.mauikit-documents

MauiKit QtQuick plugins for text editing

pkgs.cudaPackages_11.cuda_documentation

CUDA Documentation. By downloading and using the packages you accept the terms and conditions of the CUDA EULA

pkgs.python311Packages.netbox-documents

Plugin designed to faciliate the storage of site, circuit, device type and device specific documents within NetBox

pkgs.python312Packages.netbox-documents

Plugin designed to faciliate the storage of site, circuit, device type and device specific documents within NetBox

pkgs.tests.haskell.documentationTarball

  • nixos-unstable ???
    • nixos-unstable-small
    • nixpkgs-unstable

pkgs.haskellPackages.pdf-toolbox-document

A collection of tools for processing PDF files

pkgs.python311Packages.tableaudocumentapi

Python module for working with Tableau files

pkgs.python312Packages.tableaudocumentapi

Python module for working with Tableau files

pkgs.python311Packages.azure-search-documents

Microsoft Azure Cognitive Search Client Library for Python

pkgs.python312Packages.azure-search-documents

Microsoft Azure Cognitive Search Client Library for Python

pkgs.libsForQt5.mauikit-documents.x86_64-linux

MauiKit QtQuick plugins for text editing

pkgs.libsForQt5.mauikit-documents.aarch64-linux

MauiKit QtQuick plugins for text editing

pkgs.python312Packages.pydocumentdb.x86_64-linux

Azure Cosmos DB API

pkgs.python312Packages.pydocumentdb.aarch64-linux

Azure Cosmos DB API

pkgs.python312Packages.pydocumentdb.x86_64-darwin

Azure Cosmos DB API

pkgs.python312Packages.pydocumentdb.aarch64-darwin

Azure Cosmos DB API

pkgs.sbclPackages.documentation-utils.x86_64-linux

pkgs.plasma5Packages.mauikit-documents.x86_64-linux

MauiKit QtQuick plugins for text editing

pkgs.sbclPackages.documentation-utils.aarch64-linux

pkgs.sbclPackages.documentation-utils.x86_64-darwin

pkgs.plasma5Packages.mauikit-documents.aarch64-linux

MauiKit QtQuick plugins for text editing

pkgs.python312Packages.netbox-documents.x86_64-linux

Plugin designed to faciliate the storage of site, circuit, device type and device specific documents within NetBox

pkgs.sbclPackages.documentation-utils.aarch64-darwin

pkgs.python312Packages.netbox-documents.aarch64-linux

Plugin designed to faciliate the storage of site, circuit, device type and device specific documents within NetBox

pkgs.python312Packages.netbox-documents.x86_64-darwin

Plugin designed to faciliate the storage of site, circuit, device type and device specific documents within NetBox

pkgs.python312Packages.netbox-documents.aarch64-darwin

Plugin designed to faciliate the storage of site, circuit, device type and device specific documents within NetBox

pkgs.python312Packages.tableaudocumentapi.x86_64-linux

Python module for working with Tableau files

pkgs.python312Packages.tableaudocumentapi.aarch64-linux

Python module for working with Tableau files

pkgs.python312Packages.tableaudocumentapi.x86_64-darwin

Python module for working with Tableau files

pkgs.python312Packages.tableaudocumentapi.aarch64-darwin

Python module for working with Tableau files
Package maintainers: 20
CVE-2025-24684
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months, 3 weeks ago
WordPress Media Downloader Plugin <= 0.4.7.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader allows Reflected XSS. This issue affects Media Downloader: from n/a through 0.4.7.5.

media-downloader
=<0.4.7.5

pkgs.media-downloader

Qt/C++ GUI front end for yt-dlp and others
Package maintainers: 2
CVE-2025-22703
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months, 3 weeks ago
WordPress Forge – Front-End Page Builder plugin <= 1.4.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in manuelvicedo Forge – Front-End Page Builder allows Stored XSS. This issue affects Forge – Front-End Page Builder: from n/a through 1.4.6.

forge
=<1.4.6

pkgs.forge

OpenGL interop library that can be used with ArrayFire or any other application using CUDA or OpenCL compute backend

pkgs.forgejo

Self-hosted lightweight software forge

pkgs.forge-mtg

Magic: the Gathering card game with rules enforcement

pkgs.mindforger

Thinking Notebook & Markdown IDE

pkgs.forgejo-cli

CLI application for interacting with Forgejo

pkgs.forgejo-lts

Self-hosted lightweight software forge

pkgs.mcdreforged

Rewritten version of MCDaemon, a python tool to control your Minecraft server

pkgs.forge-sparks

Get Git forges notifications

pkgs.forgejo-runner

Runner for Forgejo based on act

pkgs.gnomeExtensions.forge

Tiling and window manager for GNOME
  • nixos-unstable 84
    • nixos-unstable-small 84
    • nixpkgs-unstable 84

pkgs.python312Packages.fontforge.x86_64-linux

Font editor

pkgs.python312Packages.fontforge.aarch64-linux

Font editor

pkgs.python312Packages.fontforge.x86_64-darwin

Font editor

pkgs.python312Packages.fontforge.aarch64-darwin

Font editor
Package maintainers: 16
CVE-2023-4911
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 7 months ago
Glibc: buffer overflow in ld.so leading to privilege escalation

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

glibc
*
<2.39
compat-glibc
redhat-virtualization-host
*
redhat-release-virtualization-host
*

pkgs.mtrace

Perl script used to interpret and provide human readable output of the trace log contained in the file mtracedata, whose contents were produced by mtrace(3)

pkgs.glibcLocales

Locale information for the GNU C Library

pkgs.glibcLocalesUtf8

Locale information for the GNU C Library

pkgs.locale.x86_64-linux

pkgs.locale.aarch64-linux

pkgs.libiconv.x86_64-linux

pkgs.libiconv.aarch64-linux

Package maintainers: 2
CVE-2024-22029
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 7 months ago
tomcat packaging allows for escalation to root from tomcat user

Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root

tomcat
<9.0.85-150200.57.1
<9.0.85-3.1

pkgs.tomcat9

Implementation of the Java Servlet and JavaServer Pages technologies

pkgs.tomcat10

Implementation of the Java Servlet and JavaServer Pages technologies

pkgs.tomcat11

Implementation of the Java Servlet and JavaServer Pages technologies

pkgs.tomcat-native

Optional component for use with Apache Tomcat that allows Tomcat to use certain native resources for performance, compatibility, etc
Package maintainers: 2