Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2010

NIXPKGS-2026-2010
published 6 hours ago
You track: security issues < 2026.2.16593
Permalink CVE-2026-49370
3.4 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 hours ago by @LeSuisse Activity log
  • Created suggestion 4 weeks ago
  • @LeSuisse accepted 6 hours ago
  • @LeSuisse published on GitHub 6 hours ago
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on …

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

Affected products

YouTrack
  • <2026.1.13162

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-57926
2.6 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 hours ago by @LeSuisse Activity log
  • Created suggestion 12 hours ago
  • @LeSuisse accepted 6 hours ago
  • @LeSuisse published on GitHub 6 hours ago
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable …

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

Affected products

YouTrack
  • <2026.2.16593

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-57925
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 hours ago by @LeSuisse Activity log
  • Created suggestion 12 hours ago
  • @LeSuisse accepted 6 hours ago
  • @LeSuisse published on GitHub 6 hours ago
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading …

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

Affected products

YouTrack
  • <2026.2.16593

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-57924
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 hours ago by @LeSuisse Activity log
  • Created suggestion 12 hours ago
  • @LeSuisse accepted 6 hours ago
  • @LeSuisse published on GitHub 6 hours ago
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive …

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details

Affected products

YouTrack
  • <2026.2.16593

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-57922
3.1 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 hours ago by @LeSuisse Activity log
  • Created suggestion 12 hours ago
  • @LeSuisse accepted 6 hours ago
  • @LeSuisse published on GitHub 6 hours ago
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the …

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

Affected products

YouTrack
  • <2026.2.16593

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-57923
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 hours ago by @LeSuisse Activity log
  • Created suggestion 12 hours ago
  • @LeSuisse accepted 6 hours ago
  • @LeSuisse published on GitHub 6 hours ago
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app …

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

Affected products

YouTrack
  • <2026.2.16593

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-57921
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 hours ago by @LeSuisse Activity log
  • Created suggestion 12 hours ago
  • @LeSuisse accepted 6 hours ago
  • @LeSuisse published on GitHub 6 hours ago
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading …

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

Affected products

YouTrack
  • <2026.2.16593

Matching in nixpkgs

Package maintainers