⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Automatically generated suggestions

Create Draft to queue a suggestion for refinement.

Dismiss to remove a suggestion from the queue.

CVE-2025-46448
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 5 months ago
WordPress Document Management System <= 1.24 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reifsnyderb Document Management System allows Reflected XSS. This issue affects Document Management System: from n/a through 1.24.

dms
=<1.24

pkgs.dms

UPnP DLNA Digital Media Server with basic video transcoding

pkgs.haskellPackages.amazonka-dms

Amazon Database Migration Service SDK

pkgs.python311Packages.types-aiobotocore-dms

Type annotations for aiobotocore dms

pkgs.python313Packages.types-aiobotocore-dms

Type annotations for aiobotocore dms

pkgs.python312Packages.ndms2-client.x86_64-linux

Keenetic NDMS 2.x and 3.x client

pkgs.python312Packages.ndms2-client.aarch64-linux

Keenetic NDMS 2.x and 3.x client

pkgs.python312Packages.ndms2-client.x86_64-darwin

Keenetic NDMS 2.x and 3.x client

pkgs.python312Packages.mypy-boto3-dms.x86_64-linux

Type annotations for boto3 dms

pkgs.python312Packages.ndms2-client.aarch64-darwin

Keenetic NDMS 2.x and 3.x client

pkgs.python312Packages.mypy-boto3-dms.aarch64-linux

Type annotations for boto3 dms

pkgs.python312Packages.mypy-boto3-dms.x86_64-darwin

Type annotations for boto3 dms

pkgs.python312Packages.mypy-boto3-dms.aarch64-darwin

Type annotations for boto3 dms

pkgs.python312Packages.types-aiobotocore-dms.x86_64-linux

Type annotations for aiobotocore dms

pkgs.python312Packages.types-aiobotocore-dms.aarch64-linux

Type annotations for aiobotocore dms

pkgs.python312Packages.types-aiobotocore-dms.x86_64-darwin

Type annotations for aiobotocore dms

pkgs.python312Packages.types-aiobotocore-dms.aarch64-darwin

Type annotations for aiobotocore dms
Package maintainers: 9
CVE-2025-32293
8.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 5 months ago
WordPress Finance Consultant <= 2.8 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Finance Consultant allows Object Injection. This issue affects Finance Consultant: from n/a through 2.8.

finance
=<2.8

pkgs.python311Packages.yfinance

Module to doiwnload Yahoo! Finance market data

pkgs.python313Packages.yfinance

Module to doiwnload Yahoo! Finance market data

pkgs.python311Packages.mplfinance

Matplotlib utilities for the visualization, and visual analysis, of financial data

pkgs.python313Packages.mplfinance

Matplotlib utilities for the visualization, and visual analysis, of financial data

pkgs.python311Packages.finvizfinance

Finviz Finance information downloader

pkgs.python312Packages.finvizfinance

Finviz Finance information downloader

pkgs.python313Packages.finvizfinance

Finviz Finance information downloader

pkgs.python312Packages.yfinance.x86_64-linux

Module to doiwnload Yahoo! Finance market data

pkgs.python312Packages.yfinance.aarch64-linux

Module to doiwnload Yahoo! Finance market data

pkgs.python312Packages.yfinance.x86_64-darwin

Module to doiwnload Yahoo! Finance market data

pkgs.python312Packages.mplfinance.x86_64-linux

Matplotlib utilities for the visualization, and visual analysis, of financial data

pkgs.python312Packages.yfinance.aarch64-darwin

Module to doiwnload Yahoo! Finance market data

pkgs.python312Packages.mplfinance.aarch64-linux

Matplotlib utilities for the visualization, and visual analysis, of financial data

pkgs.python312Packages.mplfinance.x86_64-darwin

Matplotlib utilities for the visualization, and visual analysis, of financial data

pkgs.python312Packages.mplfinance.aarch64-darwin

Matplotlib utilities for the visualization, and visual analysis, of financial data

pkgs.python312Packages.finvizfinance.x86_64-linux

Finviz Finance information downloader

pkgs.python312Packages.finvizfinance.aarch64-linux

Finviz Finance information downloader

pkgs.python312Packages.finvizfinance.x86_64-darwin

Finviz Finance information downloader

pkgs.python312Packages.finvizfinance.aarch64-darwin

Finviz Finance information downloader
Package maintainers: 2
CVE-2024-22309
8.7 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
created 5 months ago
WordPress ChatBot Plugin <= 5.1.0 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in QuantumCloud ChatBot with AI.This issue affects ChatBot with AI: from n/a through 5.1.0.

chatbot
=<5.1.0

pkgs.gnomeExtensions.penguin-ai-chatbot

A GNOME Shell extension that provides a chatbot interface using various LLM providers, including Anthropic, OpenAI, Gemini, and OpenRouter. Features include multiple provider support, customizable models, chat history, customizable appearance, a keyboard shortcut, and copy-to-clipboard functionality.
  • nixos-25.05 22
    • nixpkgs-25.05-darwin 22
    • nixos-25.05-small 22
  • nixos-unstable 11
    • nixos-unstable-small 11
    • nixpkgs-unstable 11
Package maintainers: 1
CVE-2023-52125
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 5 months ago
WordPress iFrame Plugin <= 4.8 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly iframe allows Stored XSS.This issue affects iframe: from n/a through 4.8.

iframe
=<4.8
CVE-2025-31423
9.8 CRITICAL
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 5 months ago
WordPress Umberto <= 1.2.8 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in AncoraThemes Umberto allows Object Injection. This issue affects Umberto: from n/a through 1.2.8.

umberto
=<1.2.8

pkgs.vimPlugins.vim-numbertoggle.x86_64-linux

pkgs.vimPlugins.vim-numbertoggle.aarch64-linux

pkgs.vimPlugins.vim-numbertoggle.x86_64-darwin

pkgs.vimPlugins.vim-numbertoggle.aarch64-darwin

CVE-2025-32285
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 5 months ago
WordPress Butcher theme <= 2.40 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Butcher allows Reflected XSS. This issue affects Butcher: from n/a through 2.40.

butcher
=<2.40

pkgs.haskellPackages.butcher.x86_64-linux

Chops a command or program invocation into digestable pieces

pkgs.haskellPackages.butcher.aarch64-linux

Chops a command or program invocation into digestable pieces

pkgs.haskellPackages.butcher.x86_64-darwin

Chops a command or program invocation into digestable pieces

pkgs.haskellPackages.butcher.aarch64-darwin

Chops a command or program invocation into digestable pieces
CVE-2025-5024
7.4 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 5 months ago
Gnome-remote-desktop: uncontrolled resource consumption due to malformed rdp pdus

A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result in gnome-remote-desktop no longer being able to open files even after it is restarted via systemd.

gnome-remote-desktop
*

pkgs.gnome-remote-desktop

GNOME Remote Desktop server
Package maintainers: 4
CVE-2024-6409
7.0 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): HIGH
created 5 months ago
Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.

rhcos
*
OpenSSH
openssh
*

pkgs.openssh_hpn

Implementation of the SSH protocol with high performance networking patches

pkgs.openssh_hpnWithKerberos

Implementation of the SSH protocol with high performance networking patches

pkgs.lxqt.lxqt-openssh-askpass

GUI to query passwords on behalf of SSH agents

pkgs.perl538Packages.NetOpenSSH

Perl SSH client package implemented on top of OpenSSH

pkgs.perl540Packages.NetOpenSSH

Perl SSH client package implemented on top of OpenSSH

pkgs.perl540Packages.NetOpenSSH.x86_64-linux

Perl SSH client package implemented on top of OpenSSH

pkgs.perl540Packages.NetOpenSSH.aarch64-linux

Perl SSH client package implemented on top of OpenSSH

pkgs.perl540Packages.NetOpenSSH.x86_64-darwin

Perl SSH client package implemented on top of OpenSSH

pkgs.perl540Packages.NetOpenSSH.aarch64-darwin

Perl SSH client package implemented on top of OpenSSH
Package maintainers: 6
CVE-2024-6505
6.8 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 5 months ago
Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

qemu
<9.1.0
qemu-kvm
qemu-kvm-ma
virt:av/qemu-kvm
virt:rhel/qemu-kvm

pkgs.qemu_kvm

Generic and open source machine emulator and virtualizer

pkgs.qemu_xen

Generic and open source machine emulator and virtualizer

pkgs.qemu-user

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu_full

Generic and open source machine emulator and virtualizer

pkgs.qemu_test

Generic and open source machine emulator and virtualizer

pkgs.qemu-utils

Generic and open source machine emulator and virtualizer

pkgs.qemu.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_xen.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.python311Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.python313Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.qemu-user.x86_64-linux

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu_full.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_test.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu-user.aarch64-linux

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu-utils.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_full.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_full.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_test.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_test.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu-utils.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu-utils.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_full.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_test.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu-utils.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu-python-utils.x86_64-linux

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.qemu-python-utils.aarch64-linux

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.qemu-python-utils.x86_64-darwin

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.qemu-python-utils.aarch64-darwin

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.python312Packages.qemu.x86_64-linux

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.python312Packages.qemu.aarch64-linux

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.python312Packages.qemu.x86_64-darwin

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.python312Packages.qemu.aarch64-darwin

Python tooling used by the QEMU project to build, configure, and test QEMU
Package maintainers: 11
CVE-2025-2559
4.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 5 months ago
Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak

A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system.

keycloak
<26.0.11
<26.1.5
keycloak-services
rhbk/keycloak-rhel9
*
keycloak-rhel9-container
*
rhbk/keycloak-rhel9-operator
*
rhbk/keycloak-operator-bundle
*
keycloak-rhel9-operator-container
*
keycloak-rhel9-operator-bundle-container
*

pkgs.python311Packages.python-keycloak

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak

Provides access to the Keycloak API

pkgs.python313Packages.python-keycloak

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.x86_64-linux

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.aarch64-linux

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.x86_64-darwin

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.aarch64-darwin

Provides access to the Keycloak API
Package maintainers: 3