Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: php83Packages.composer-local-repo-plugin

Found 5 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-32657
7.3 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 3 weeks, 4 days ago Activity log
  • Created suggestion 3 weeks, 4 days ago
Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell …

Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Version 10.3.0, Dell Unity Version 5.4, Dell PowerFlex Manager Version 4.5.4, Dell PowerFlex Intelligent Catalog Versions 46.377.00 and 46.382.00 and Dell PowerFlex Rack version 4.5.4 and prior versions, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Affected products

Unity
  • <5.5.2 or later
VxRail
  • <8.0.330 or later
AppSync
  • <4.6.0.4 or later
PowerMax
  • <10.3.1.0 Patch 11248 or later
UCC Edge
  • <3.0.2 or later
Metro Node
  • <4.6.0.4 or later
PowerFlex Rack
  • <4.5.5 or later
PowerFlex Manager
  • <4.5.5 or later
PowerFlex Intelligent Catalog
  • <48.383.00 or later
  • <48.378.00 or later

Matching in nixpkgs

pkgs.unityhub

Official Unity3D app to download and manage Unity Projects and installations

pkgs.kubemq-community

KubeMQ Community is the open-source version of KubeMQ, the Kubernetes native message broker

pkgs.documize-community

Open source Confluence alternative for internal & external docs built with Golang + EmberJS

Package maintainers

Untriaged
Permalink CVE-2026-71234
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 1 month, 1 week ago Activity log
  • Created suggestion 1 month, 1 week ago
Documize Community: Attachment Download Authorization Bypass via Non-Validated secure Token

Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a `secure` query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value. Any non-empty string, such as ?secure=x, bypasses authentication entirely and allows downloading any organization's attachments. Sibling handlers in the same file (togglePublish, delete) correctly enforce session-based authorization, confirming this is an inconsistency rather than intended design.

Affected products

community
  • ==0

Matching in nixpkgs

pkgs.kubemq-community

KubeMQ Community is the open-source version of KubeMQ, the Kubernetes native message broker

pkgs.documize-community

Open source Confluence alternative for internal & external docs built with Golang + EmberJS

Package maintainers

Untriaged
Permalink CVE-2026-45793
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 1 month, 3 weeks ago Activity log
  • Created suggestion 1 month, 3 weeks ago
Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

Affected products

composer
  • ==>= 2.0.0, < 2.2.28
  • ==>= 2.3.0, < 2.9.8
  • ==>= 1.0, < 1.10.28

Matching in nixpkgs

pkgs.composer-require-checker

CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies

Package maintainers

Untriaged
Permalink CVE-2026-11914
created 1 month, 4 weeks ago Activity log
  • Created suggestion 1 month, 4 weeks ago
Composer - Critical - Unsupported - SA-CONTRIB-2026-046

vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

Affected products

Composer
  • ==*.*

Matching in nixpkgs

pkgs.composer-require-checker

CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies

Package maintainers

Untriaged
Permalink CVE-2026-10043
7.8 HIGH
  • CVSS version (CVSS): 3.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability

MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27990.

References

Affected products

Composer
  • ==0.32.1

Matching in nixpkgs

pkgs.composer-require-checker

CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies