Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: svox

Found 2 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-73660
7.5 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 1 week, 3 days ago Activity log
  • Created suggestion 1 week, 3 days ago
FreePBX: Authenticated TTS AGI Command Injection Through TTS Name

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. The TTS destination name reaches a raw shell-command execution path, allowing arbitrary operating-system command execution as the asterisk service user. This issue is fixed in versions 16.0.6 and 17.0.5.4.

Affected products

tts
  • ==>= 17.0.1, < 17.0.5.4
  • ==< 16.0.6

Matching in nixpkgs

pkgs.freetts

Text to speech system based on Festival written in Java

pkgs.piper-tts

Fast, local neural text to speech system

pkgs.pocket-tts

Lightweight text-to-speech (TTS) application designed to run efficiently on CPUs

pkgs.libgringotts

Small library to encapsulate data in an encrypted structure

pkgs.tts-mod-vault

Download and backup assets for your Tabletop Simulator mods

pkgs.pkgsRocm.pocket-tts

Lightweight text-to-speech (TTS) application designed to run efficiently on CPUs

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-72574
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 1 week, 6 days ago by @LeSuisse Activity log
  • Created suggestion 1 week, 6 days ago
  • @LeSuisse dismissed (not in Nixpkgs) 1 week, 6 days ago
picocms Pico - Host Header Injection Enables Script Source Hijacking

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.

References

Affected products

Pico
  • =<2.1.4

Matching in nixpkgs

pkgs.picom

Fork of XCompMgr, a sample compositing manager for X servers

  • nixos-unstable 13
    • nixpkgs-unstable 13
    • nixos-unstable-small 13
  • nixos-26.05 13
    • nixos-26.05-small 13
    • nixpkgs-26.05-darwin 13

pkgs.picosat

SAT solver with proof and core support

  • nixos-unstable 965
    • nixpkgs-unstable 965
    • nixos-unstable-small 965
  • nixos-26.05 965
    • nixos-26.05-small 965
    • nixpkgs-26.05-darwin 965

pkgs.pico-sdk

SDK provides the headers, libraries and build system necessary to write programs for the RP2040-based devices

pkgs.picoclaw

Tiny, Fast, and Deployable anywhere - automate the mundane, unleash your creativity

pkgs.picoleaf

A tiny CLI tool for controlling Nanoleaf

pkgs.picoloop

Synth and a stepsequencer (a clone of the famous nanoloop)

pkgs.picotool

Tool for interacting with RP2040/RP2350 device(s) in BOOTSEL mode, or with an RP2040/RP2350 binary

pkgs.picocrypt

Very small, very simple, yet very secure encryption tool, written in Go

  • nixos-unstable 1.49
    • nixpkgs-unstable 1.49
    • nixos-unstable-small 1.49
  • nixos-26.05 1.49
    • nixos-26.05-small 1.49
    • nixpkgs-26.05-darwin 1.49

pkgs.picoshare

Minimalist, easy-to-host service for sharing images and other files

pkgs.picosnitch

Monitor network traffic per executable using BPF

pkgs.picocrypt-ng

Very small, very simple, yet very secure encryption tool

  • nixos-unstable 2.17
    • nixpkgs-unstable 2.17
    • nixos-unstable-small 2.18
  • nixos-26.05 2.09
    • nixos-26.05-small 2.09
    • nixpkgs-26.05-darwin 2.09

pkgs.picocrypt-cli

Command-line interface for Picocrypt

  • nixos-unstable 1.49
    • nixpkgs-unstable 1.49
    • nixos-unstable-small 1.49
  • nixos-26.05 1.49
    • nixos-26.05-small 1.49
    • nixpkgs-26.05-darwin 1.49

pkgs.gnomeExtensions.topiconsfix

Shows legacy tray icons on top – the fixed version of https://extensions.gnome.org/extension/495/topicons/

  • nixos-unstable 23
    • nixpkgs-unstable 23
    • nixos-unstable-small 23
  • nixos-26.05 23
    • nixos-26.05-small 23
    • nixpkgs-26.05-darwin 23

Package maintainers