⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Automatically generated suggestions

Create Draft to queue a suggestion for refinement.

Dismiss to remove a suggestion from the queue.

CVE-2025-5351
4.2 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 4 weeks, 1 day ago
Libssh: double free vulnerability in libssh key export functions

A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.

rhcos
libssh
libssh2

pkgs.libssh

SSH client library

pkgs.libssh2

Client-side C library implementing the SSH2 protocol

pkgs.haskellPackages.libssh

libssh bindings

pkgs.python312Packages.ansible-pylibssh

Python bindings to client functionality of libssh specific to Ansible use case

pkgs.python313Packages.ansible-pylibssh

Python bindings to client functionality of libssh specific to Ansible use case

pkgs.tests.pkg-config.defaultPkgConfigPackages.libssh2

Test whether libssh2-1.11.1 exposes pkg-config modules libssh2
Package maintainers: 3
CVE-2024-9453
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 4 weeks, 1 day ago
Jenkins-image: sensitive data disclosure when using openshift jenkins image

A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information.

jenkins

pkgs.jenkins

Extendable open source continuous integration server

pkgs.jenkins-job-builder

Jenkins Job Builder is a system for configuring Jenkins jobs using simple YAML files stored in Git

pkgs.python312Packages.jenkinsapi

Python API for accessing resources on a Jenkins continuous-integration server

pkgs.python313Packages.jenkinsapi

Python API for accessing resources on a Jenkins continuous-integration server

pkgs.python312Packages.python-jenkins

Python bindings for the remote Jenkins API

pkgs.python313Packages.python-jenkins

Python bindings for the remote Jenkins API

pkgs.python312Packages.jenkins-job-builder

Jenkins Job Builder is a system for configuring Jenkins jobs using simple YAML files stored in Git

pkgs.python313Packages.jenkins-job-builder

Jenkins Job Builder is a system for configuring Jenkins jobs using simple YAML files stored in Git
Package maintainers: 8
CVE-2025-5372
5.0 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 4 weeks, 1 day ago
Libssh: incorrect return code handling in ssh_kdf() in libssh

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

rhcos
libssh
libssh2

pkgs.libssh

SSH client library

pkgs.libssh2

Client-side C library implementing the SSH2 protocol

pkgs.haskellPackages.libssh

libssh bindings

pkgs.python312Packages.ansible-pylibssh

Python bindings to client functionality of libssh specific to Ansible use case

pkgs.python313Packages.ansible-pylibssh

Python bindings to client functionality of libssh specific to Ansible use case

pkgs.tests.pkg-config.defaultPkgConfigPackages.libssh2

Test whether libssh2-1.11.1 exposes pkg-config modules libssh2
Package maintainers: 3
CVE-2025-52799
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 4 weeks, 1 day ago
WordPress LMS theme <= 9.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes LMS allows Reflected XSS. This issue affects LMS: from n/a through 9.1.

lms
=<9.1

pkgs.lms

Lightweight Music Server - Access your self-hosted music using a web interface

pkgs.flmsg

Digital modem message program

pkgs.helmsman

Helm Charts (k8s applications) as Code tool

pkgs.lmstudio

LM Studio is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)

pkgs.python312Packages.calmsize

Take a number of bytes and return a human-readable string

pkgs.python313Packages.calmsize

Take a number of bytes and return a human-readable string

pkgs.python312Packages.dlms-cosem

Python module to parse DLMS/COSEM

pkgs.python313Packages.dlms-cosem

Python module to parse DLMS/COSEM

pkgs.python312Packages.llama-index-llms-ollama

LlamaIndex LLMS Integration for ollama

pkgs.python312Packages.llama-index-llms-openai

LlamaIndex LLMS Integration for OpenAI

pkgs.python313Packages.llama-index-llms-ollama

LlamaIndex LLMS Integration for ollama

pkgs.python313Packages.llama-index-llms-openai

LlamaIndex LLMS Integration for OpenAI

pkgs.python312Packages.llama-index-llms-openai-like

LlamaIndex LLMS Integration for OpenAI like

pkgs.python313Packages.llama-index-llms-openai-like

LlamaIndex LLMS Integration for OpenAI like

pkgs.python312Packages.llama-index-multi-modal-llms-openai

LlamaIndex Multi-Modal-Llms Integration for OpenAI

pkgs.python313Packages.llama-index-multi-modal-llms-openai

LlamaIndex Multi-Modal-Llms Integration for OpenAI
Package maintainers: 7
CVE-2025-53338
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 4 weeks, 1 day ago
WordPress re.place plugin <= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in dor re.place allows Stored XSS. This issue affects re.place: from n/a through 0.2.1.

replace
=<0.2.1

pkgs.replace

Tool to replace verbatim strings

pkgs.qsreplace

Accept URLs on stdin, replace all query string values with a user-supplied value

pkgs.replacement

Tool to execute yaml templates and output text

pkgs.replace-secret

Replace a string in one file with a secret from a second file
  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.haskellPackages.replace-attoparsec

Find, replace, split string patterns with Attoparsec parsers (instead of regex)

pkgs.haskellPackages.replace-megaparsec

Find, replace, split string patterns with Megaparsec parsers (instead of regex)

pkgs.haskellPackages.text-regex-replace

Easy replacement when using text-icu regexes

pkgs.tests.substitute.legacySingleReplace

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVars.succeeds

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVarsWith.succeeds

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVars.fails-on-directory

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVars.fails-in-build-phase

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVars.fails-in-check-phase

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVarsWith.fails-on-directory

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVars.succeeds-with-exemption

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVarsWith.fails-in-build-phase

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVarsWith.fails-in-check-phase

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVarsWith.succeeds-with-exemption

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVars.fails-in-check-phase-with-exemption

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVars.fails-in-check-phase-with-bad-exemption

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVarsWith.fails-in-check-phase-with-exemption

  • nixos-unstable ???
    • nixpkgs-unstable

pkgs.tests.replaceVars.replaceVarsWith.fails-in-check-phase-with-bad-exemption

  • nixos-unstable ???
    • nixpkgs-unstable
Package maintainers: 5
CVE-2025-53200
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 4 weeks, 1 day ago
WordPress ChatBot plugin <= 6.7.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in QuantumCloud ChatBot allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ChatBot: from n/a through 6.7.3.

chatbot
=<6.7.3

pkgs.gnomeExtensions.penguin-ai-chatbot

A GNOME Shell extension that provides a chatbot interface using various LLM providers, including Anthropic, OpenAI, Gemini, and OpenRouter. Features include multiple provider support, customizable models, chat history, customizable appearance, a keyboard shortcut, and copy-to-clipboard functionality.
Package maintainers: 1
CVE-2025-31428
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 4 weeks, 1 day ago
WordPress HYDRO theme <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddhaThemes HYDRO allows Reflected XSS. This issue affects HYDRO: from n/a through 2.8.

hydro
=<2.8

pkgs.hydrogen

Advanced drum machine

pkgs.hydroxide

Third-party, open-source ProtonMail bridge

pkgs.libhydrogen

Lightweight, secure, easy-to-use crypto library suitable for constrained environments

pkgs.tau-hydrogen

GTK icon theme for tauOS

pkgs.hydrogen-web-unwrapped

Lightweight matrix client with legacy and mobile browser support

pkgs.python312Packages.hydrogram

Asynchronous Telegram MTProto API framework for fluid user and bot interactions

pkgs.python313Packages.hydrogram

Asynchronous Telegram MTProto API framework for fluid user and bot interactions

pkgs.haskellPackages.hydrogen-version

Hydrogen Version Type

pkgs.python312Packages.swisshydrodata

Python client to get data from the Swiss federal Office for Environment FEON

pkgs.python313Packages.swisshydrodata

Python client to get data from the Swiss federal Office for Environment FEON
Package maintainers: 12
CVE-2025-52826
8.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 4 weeks, 1 day ago
WordPress Sala theme <= 1.1.3 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in uxper Sala allows Object Injection. This issue affects Sala: from n/a through 1.1.3.

sala
=<1.1.3

pkgs.python312Packages.datasalad

Pure-Python library with a collection of utilities for working with Git and git-annex

pkgs.python313Packages.datasalad

Pure-Python library with a collection of utilities for working with Git and git-annex

pkgs.python312Packages.schema-salad

Semantic Annotations for Linked Avro Data

pkgs.python313Packages.schema-salad

Semantic Annotations for Linked Avro Data
Package maintainers: 2
CVE-2025-52816
8.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 4 weeks, 1 day ago
WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita allows PHP Local File Inclusion. This issue affects Zita: from n/a through 1.6.5.

zita
=<1.6.5

pkgs.zitadel

Identity and access management platform

pkgs.zita-at1

Autotuner Jack application to correct the pitch of vocal tracks

pkgs.zita-ajbridge

Connect additional ALSA devices to JACK

pkgs.zita-njbridge

Command line Jack clients to transmit full quality multichannel audio over a local IP network

pkgs.zitadel-tools

Helper tools for zitadel

pkgs.zita-alsa-pcmi

Successor of clalsadrv, provides easy access to ALSA PCM devices

pkgs.zita-convolver

Convolution library by Fons Adriaensen

pkgs.zita-resampler

Resample library by Fons Adriaensen
Package maintainers: 3
CVE-2025-53331
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 4 weeks, 1 day ago
WordPress RSS Digest plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in samcharrington RSS Digest allows Stored XSS. This issue affects RSS Digest: from n/a through 1.5.

rss-digest
=<1.5

pkgs.matcha-rss-digest

Daily digest generator from a list of RSS feeds
Package maintainers: 1