Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestions search

All statuses
Filter by:
With package: net-news-wire

Found 2 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-61695
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
created 2 days, 1 hour ago Activity log
  • Created suggestion 2 days, 1 hour ago
Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

Affected products

wire
  • ==< 6.4.1
  • ==>= 7.0.0-alpha01, < 7.0.0-alpha04

Matching in nixpkgs

pkgs.wire

Code generation tool that automates connecting components using dependency injection

  • nixos-unstable -
    • nixos-unstable-small 0.7.0
  • nixos-26.05 -
    • nixos-26.05-small 0.7.0

pkgs.wired

Lightweight notification daemon written in Rust

  • nixos-unstable -
  • nixos-26.05 -

pkgs.tshark

Powerful network protocol analyzer

  • nixos-unstable -
    • nixos-unstable-small 4.6.9
  • nixos-26.05 -
    • nixos-26.05-small 4.6.8

pkgs.mozwire

MozillaVPN configuration manager giving Linux, macOS users (among others), access to MozillaVPN

  • nixos-unstable -
    • nixos-unstable-small 0.8.1
  • nixos-26.05 -
    • nixos-26.05-small 0.8.1

pkgs.ripwire

The ripgrep of AI context: a zero-dependency C++23 CLI + MCP server giving coding agents a ranked, deterministic map of any repo, blast radius, tests-to-run and quality deltas. Signatures at 80% fewer bytes than bodies; ~5% of a grep-and-read pass's tokens

  • nixos-unstable -
    • nixos-unstable-small 0.6.1

pkgs.wiremix

Simple TUI mixer for PipeWire

  • nixos-unstable -
  • nixos-26.05 -

pkgs.wireviz

Easily document cables and wiring harnesses

  • nixos-unstable -
    • nixos-unstable-small 0.4.1
  • nixos-26.05 -
    • nixos-26.05-small 0.4.1

pkgs.cardwire

GPU manager for laptop and workstation

  • nixos-unstable -

pkgs.hyprwire

A fast and consistent wire protocol for IPC

  • nixos-unstable -
    • nixos-unstable-small 0.3.1
  • nixos-26.05 -
    • nixos-26.05-small 0.3.1

pkgs.pipewire

Server and user space API to deal with multimedia pipelines

  • nixos-unstable -
    • nixos-unstable-small 1.6.8
  • nixos-26.05 -
    • nixos-26.05-small 1.6.6

pkgs.wiremock

Flexible tool for building mock APIs

  • nixos-unstable -
  • nixos-26.05 -

pkgs.wireproxy

Wireguard client that exposes itself as a socks5 proxy

  • nixos-unstable -
    • nixos-unstable-small 1.1.3
  • nixos-26.05 -
    • nixos-26.05-small 1.1.2

pkgs.wireshark

Powerful network protocol analyzer

  • nixos-unstable -
    • nixos-unstable-small 4.6.9
  • nixos-26.05 -
    • nixos-26.05-small 4.6.8

pkgs.wireworld

Fascinating electronics logic puzzles, game where you'll learn how to build clocks, diodes, and logic gates

pkgs.wiredtiger

High performance, scalable, NoSQL, extensible platform for data management

  • nixos-unstable -
  • nixos-26.05 -

pkgs.wireplumber

Modular session / policy manager for PipeWire

  • nixos-unstable -
  • nixos-26.05 -

pkgs.wireguard-ui

Web user interface to manage your WireGuard setup

  • nixos-unstable -
    • nixos-unstable-small 0.6.2
  • nixos-26.05 -
    • nixos-26.05-small 0.6.2

pkgs.wireshark-qt

Powerful network protocol analyzer

  • nixos-unstable -
    • nixos-unstable-small 4.6.9
  • nixos-26.05 -
    • nixos-26.05-small 4.6.8

pkgs.frostwire-bin

BitTorrent Client and Cloud File Downloader

  • nixos-unstable -
  • nixos-26.05 -

pkgs.net-news-wire

RSS reader for macOS and iOS

  • nixos-unstable -
    • nixos-unstable-small 7.1.3
  • nixos-26.05 -
    • nixos-26.05-small 7.0.5

pkgs.wireshark-cli

Powerful network protocol analyzer

  • nixos-unstable -
    • nixos-unstable-small 4.6.9
  • nixos-26.05 -
    • nixos-26.05-small 4.6.8

pkgs.soundwireserver

Turn your Android device into wireless headphones / wireless speaker

  • nixos-unstable -
    • nixos-unstable-small 3.0
  • nixos-26.05 -
    • nixos-26.05-small 3.0

pkgs.kdePackages.kpipewire

Components relating to Flatpak 'pipewire' use in Plasma.

  • nixos-unstable -
    • nixos-unstable-small 6.7.5
  • nixos-26.05 -
    • nixos-26.05-small 6.6.6

pkgs.haskellPackages.proto3-wire

A low-level implementation of the Protocol Buffers (version 3) wire format

  • nixos-unstable -
    • nixos-unstable-small 1.4.6
  • nixos-26.05 -
    • nixos-26.05-small 1.4.6

pkgs.gnomeExtensions.wireless-hid

This extension shows the battery of the wireless keyboards, mice, and game controllers in percentages and colors. Multiple devices are supported.

  • nixos-unstable -
    • nixos-unstable-small 23
  • nixos-26.05 -
    • nixos-26.05-small 23

pkgs.wayland-pipewire-idle-inhibit

Suspends automatic idling of Wayland compositors when media is being played through Pipewire

  • nixos-unstable -
    • nixos-unstable-small 0.7.1
  • nixos-26.05 -
    • nixos-26.05-small 0.7.1

pkgs.gnomeExtensions.cardwire-gpu-toggle

Quick Settings toggle for hardware-supported GPU modes via the cardwire D-Bus daemon. Designed for dual-GPU laptops.

  • nixos-unstable -
    • nixos-unstable-small 5
  • nixos-26.05 -
    • nixos-26.05-small 1

pkgs.gnomeExtensions.pipewire-airplay-toggle

Quick Setting menu toggle to enable/disable the RAOP Discover Module in PipeWire, allowing users to quickly and easily show or hide their AirPlay enabled speakers. This extension now also supports PulseAudio starting from version 8. For full details and dependency information, please review the GitHub repository wiki.

  • nixos-unstable -
    • nixos-unstable-small 12
  • nixos-26.05 -
    • nixos-26.05-small 12

Package maintainers

Untriaged
Permalink CVE-2026-44515
2.3 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): Low (L)
  • Subsequent System Impact Integrity (SI): Low (L)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Low (L)
  • Modified Subsequent System Impact Integrity (MSI): Low (L)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 4 months, 1 week ago Activity log
  • Created suggestion 4 months, 1 week ago
Nextcloud News: Authenticated blind SSRF via feed URL

Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-beta.1, Nextcloud News allows authenticated users to add feeds by providing a feed URL (via the web interface or the API). In affected versions, an authenticated attacker could provide a URL pointing to internal/private IP ranges or localhost, causing the Nextcloud server to perform server-side HTTP requests to attacker-controlled destinations, but not relaying the result. This enables blind SSRF, which can be used to scan or probe internal network services that are reachable from the Nextcloud server. This vulnerability is fixed in 28.3.0-beta.1.

Affected products

news
  • ==< 28.3.0-beta.1

Matching in nixpkgs

pkgs.newsboat

Fork of Newsbeuter, an RSS/Atom feed reader for the text console

  • nixos-unstable -
    • nixos-unstable-small 2.44
  • nixos-26.05 -
    • nixos-26.05-small 2.43

pkgs.newsraft

Feed reader for terminal

  • nixos-unstable -
    • nixos-unstable-small 0.37
  • nixos-26.05 -
    • nixos-26.05-small 0.35

pkgs.newsflash

Modern feed reader designed for the GNOME desktop

  • nixos-unstable -
    • nixos-unstable-small 5.2.5
  • nixos-26.05 -
    • nixos-26.05-small 5.1.0

pkgs.net-news-wire

RSS reader for macOS and iOS

  • nixos-unstable -
    • nixos-unstable-small 7.1.3
  • nixos-26.05 -
    • nixos-26.05-small 7.0.5

pkgs.hackernews-tui

A Terminal UI to browse Hacker News

  • nixos-unstable -

Package maintainers