Nixpkgs Security Tracker

Permalink CVE-2025-68546

updated 2 weeks ago by @LeSuisse Activity log

Created automatic suggestion 2 weeks ago
@LeSuisse removed
3 packages
- nika-fonts
- python312Packages.minikanren
- python313Packages.minikanren
2 weeks ago
@LeSuisse dismissed 2 weeks ago

WordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Thembay Nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through 1.2.14.

Affected products

Nika

=<1.2.14

Package maintainers

@Etjean Etienne Jean <et.jean@outlook.fr>

WP theme not present in nixpkgs

Permalink CVE-2025-52750

updated 2 weeks ago by @LeSuisse Activity log

Created automatic suggestion 2 weeks ago
@LeSuisse removed package emu2 2 weeks ago
@LeSuisse dismissed 2 weeks ago

WordPress Emu2 plugin <= 0.83b - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juergen Schulze Emu2 emu2-email-users-2 allows Reflected XSS.This issue affects Emu2: from n/a through <= 0.83b.

Affected products

emu2-email-users-2

=<<= 0.83b

WP plugin not present in nixpkgs

Permalink CVE-2025-64230

updated 2 weeks ago by @LeSuisse Activity log

Created automatic suggestion 2 weeks ago
@LeSuisse removed
5 packages
- typstPackages.efilrst_0_3_2
- typstPackages.efilrst_0_3_1
- typstPackages.efilrst_0_3_0
- typstPackages.efilrst_0_2_0
- typstPackages.efilrst_0_1_0
2 weeks ago
@LeSuisse dismissed 2 weeks ago

WordPress Filr plugin <= 1.2.10 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Chill Filr filr-protection allows Path Traversal.This issue affects Filr: from n/a through <= 1.2.10.

Affected products

filr-protection

=<<= 1.2.10

Package maintainers

@cherrypiejam Gongqi Huang

WP plugin not present in nixpkgs

Permalink CVE-2025-62092

updated 2 weeks ago by @LeSuisse Activity log

Created automatic suggestion 2 weeks ago
@LeSuisse dismissed 2 weeks ago

WordPress Wiremo plugin <= 1.4.99 - Broken Access Control vulnerability

Missing Authorization vulnerability in Wiremo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wiremo: from n/a through 1.4.99.

Affected products

woo-reviews-by-wiremo

=<1.4.99

Matching in nixpkgs

pkgs.wiremock

Flexible tool for building mock APIs

nixos-unstable 3.13.2
- nixpkgs-unstable 3.13.2
- nixos-unstable-small 3.13.2
nixos-25.05 3.13.0
- nixos-25.05-small 3.13.0
- nixpkgs-25.05-darwin 3.13.0

Package maintainers

@bobvanderlinden Bob van der Linden <bobvanderlinden@gmail.com>
@anthonyroussel Anthony Roussel <anthony@roussel.dev>

WP plugin not present in nixpkgs

Permalink CVE-2025-58942

updated 2 weeks ago by @LeSuisse Activity log

Created automatic suggestion 2 weeks ago
@LeSuisse removed
3 packages
- python312Packages.aioridwell
- python313Packages.aioridwell
- home-assistant-component-tests.ridwell
2 weeks ago
@LeSuisse dismissed 2 weeks ago

WordPress Dwell theme <= 1.7.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Dwell dwell allows PHP Local File Inclusion.This issue affects Dwell: from n/a through <= 1.7.0.

Affected products

dwell

=<<= 1.7.0

Package maintainers

@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
@dotlambda Robert Schütz <rschuetz17@gmail.com>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>

WP theme note present in nixpkgs

Permalink CVE-2025-58708

updated 2 weeks ago by @LeSuisse Activity log

Created automatic suggestion 2 weeks ago
@LeSuisse removed package tests.haskell.upstreamStackHpackVersion 2 weeks ago
@LeSuisse dismissed 2 weeks ago

WordPress 777 theme <= 1.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes 777 triple-seven allows PHP Local File Inclusion.This issue affects 777: from n/a through <= 1.3.

Affected products

triple-seven

=<<= 1.3

Package maintainers

@cdepillabout Dennis Gosnell <cdep.illabout@gmail.com>

WP theme note present in nixpkgs

Permalink CVE-2025-62759

updated 2 weeks ago by @LeSuisse Activity log

Created automatic suggestion 2 weeks ago
@LeSuisse removed
10 packages
- dsseries
- git-series
- python312Packages.eseries
- python312Packages.pyseries
- python313Packages.pyseries
- haskellPackages.timezone-series
- epson-workforce-635-nx625-series
- pkgsRocm.python3Packages.pyseries
- azure-cli-extensions.timeseriesinsights
- epson-inkjet-printer-workforce-840-series
2 weeks ago
@LeSuisse dismissed 2 weeks ago

WordPress Series plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Series allows Stored XSS.This issue affects Series: from n/a through 2.0.1.

Affected products

series

=<2.0.1

Package maintainers

@ulrikstrid Ulrik Strid <ulrik.strid@outlook.com>
@katexochen Paul Meyer <katexochen0@gmail.com>
@callahad Dan Callahan <dan.callahan@gmail.com>
@heichro heichro
@jorsn Johannes Rosenberger <johannes@jorsn.eu>
@vmandela Venkateswara Rao Mandela <venkat.mandela@gmail.com>
@edef1c edef <edef@edef.eu>
@Aleksanaa Aleksana QwQ <me@aleksana.moe>
@Sigmanificient Yohann Boniface <sigmanificient@gmail.com>
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>

WP plugin not present in nixpkgs

Permalink CVE-2025-58709

updated 2 weeks ago by @LeSuisse Activity log

Created automatic suggestion 2 weeks ago
@LeSuisse removed
37 packages
- spago
- etlegacy
- spago-legacy
- ifstat-legacy
- libewf-legacy
- geolite-legacy
- etlegacy-assets
- etlegacy-unwrapped
- rquickshare-legacy
- perlPackages.MenloLegacy
- adwaita-icon-theme-legacy
- perl538Packages.MenloLegacy
- perl540Packages.MenloLegacy
- haskellPackages.spago-legacy
- python312Packages.legacy-cgi
- python313Packages.legacy-cgi
- intel-compute-runtime-legacy1
- ocamlPackages.legacy_diffable
- php81Extensions.openssl-legacy
- php82Extensions.openssl-legacy
- php83Extensions.openssl-legacy
- php84Extensions.openssl-legacy
- python312Packages.spacy-legacy
- python313Packages.spacy-legacy
- python312Packages.legacy-api-wrap
- python313Packages.legacy-api-wrap
- python312Packages.packaging-legacy
- python312Packages.pyoppleio-legacy
- python313Packages.packaging-legacy
- python313Packages.pyoppleio-legacy
- python312Packages.llama-index-legacy
- python313Packages.llama-index-legacy
- ocamlPackages.janeStreet.legacy_diffable
- pkgsRocm.python3Packages.llama-index-legacy
- python312Packages.azure-servicemanagement-legacy
- python313Packages.azure-servicemanagement-legacy
- gnomeExtensions.legacy-gtk3-theme-scheme-auto-switcher
2 weeks ago
@LeSuisse dismissed 2 weeks ago

WordPress Legacy theme <= 1.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Legacy legacy allows PHP Local File Inclusion.This issue affects Legacy: from n/a through <= 1.9.

Affected products

legacy

=<<= 1.9

Package maintainers

@dasj19 Daniel Șerbănescu <daniel@serbanescu.dk>
@jtojnar Jan Tojnar <jtojnar@gmail.com>
@hedning Tor Hedin Brønner <torhedinbronner@gmail.com>
@bobby285271 Bobby Rong <rjl931189261@126.com>
@drupol Pol Dellaiera <pol.dellaiera@protonmail.com>
@ashleyghooper Ashley Hooper <ashleyghooper@gmail.com>
@fpletz Franz Pletz <fpletz@fnordicwalking.de>
@honnip Jung seungwoo <me@honnip.page>
@peterhoeg Peter Hoeg <peter@hoeg.com>
@fleaz Felix Breidenstein <mail@felixbreidenstein.de>
@D3vil0p3r Antonio Voza <vozaanthony@gmail.com>
@Ma27 Maximilian Bosch <maximilian@mbosch.me>
@aanderse Aaron Andersen <aaron@fosslib.net>
@talyz Kim Lindberger <kim.lindberger@gmail.com>
@piotrkwiecinski Piotr Kwiecinski <piokwiecinski+nixpkgs@gmail.com>
@olcai Erik Timan <dev@timan.info>
@mwilsoncoding Max Wilson <nixpkgs@maxwilson.dev>
@dotlambda Robert Schütz <rschuetz17@gmail.com>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@mattmelling Matt Melling <mattmelling@fastmail.com>
@luftmensch-luftmensch Valentino Bocchetti <valentinobocchetti59@gmail.com>
@PerchunPak Perchun Pak <nixpkgs@perchun.it>
@bcdarwin Ben Darwin <bcdarwin@gmail.com>
@JamieMagee Jamie Magee <jamie.magee@gmail.com>

WP theme not present in nixpkgs

Permalink CVE-2025-62137

updated 2 weeks ago by @LeSuisse Activity log

Created automatic suggestion 2 weeks ago
@LeSuisse removed
2 packages
- sshuttle
- cargo-shuttle
2 weeks ago
@LeSuisse dismissed 2 weeks ago

WordPress Shuttle theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shuttlethemes Shuttle allows Stored XSS.This issue affects Shuttle: from n/a through 1.5.0.

Affected products

shuttle

=<1.5.0

Package maintainers

@figsoda figsoda <figsoda@pm.me>
@carlosdagos Carlos D'Agostino <m@cdagostino.io>
@domenkozar Domen Kozar <domen@dev.si>

WP theme not present in nixpkgs

Permalink CVE-2025-67935

updated 2 weeks ago by @LeSuisse Activity log

Created automatic suggestion 2 weeks ago
@LeSuisse removed
10 packages
- pngoptimizer
- meshoptimizer
- openorbitaloptimizer
- elmPackages.elm-optimize-level-2
- akkuPackages.cyclone-iset-optimize
- haskellPackages.amazonka-compute-optimizer
- python312Packages.mypy-boto3-compute-optimizer
- python313Packages.mypy-boto3-compute-optimizer
- python312Packages.types-aiobotocore-compute-optimizer
- python313Packages.types-aiobotocore-compute-optimizer
2 weeks ago
@LeSuisse dismissed 2 weeks ago

WordPress Optimize theme < 2.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Optimize optimizewp allows PHP Local File Inclusion.This issue affects Optimize: from n/a through < 2.4.

Affected products

optimizewp

=<< 2.4

Package maintainers

@turboMaCk Marek Fajkus <marek.faj@gmail.com>
@bouk Bouke van der Bijl <i@bou.ke>
@lillycham Lilly Cham <lillycat332@gmail.com>
@syvb Smitty van Bodegom <me@smitop.com>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@mbalatsko Maksym Balatsko <mbalatsko@gmail.com>
@sheepforce Phillip Seeber <phillip.seeber@googlemail.com>

WP theme not present in nixpkgs

Dismissed suggestions

Affected products

Package maintainers

Affected products

Affected products

Package maintainers

Affected products

Matching in nixpkgs

pkgs.wiremock

Package maintainers

Affected products

Package maintainers

Affected products

Package maintainers

Affected products

Package maintainers

Affected products

Package maintainers

Affected products

Package maintainers

Affected products

Package maintainers