Nixpkgs security tracker

Dismissed

Permalink CVE-2026-25956

6.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
3 packages
- nixos-artwork.wallpapers.catppuccin-frappe
- nixos-artwork.wallpapers.nineish-catppuccin-frappe
- nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

Frappe Affected by XSS and Open Redirect in Sign Up

Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could lead to an open redirect (or reflected XSS, depending on the crafted payload) when a user signs up. This vulnerability is fixed in 14.99.14 and 15.94.0.