Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged

Permalink CVE-2026-16992

created 3 weeks ago Activity log

Created suggestion 3 weeks ago

Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.

References

https://wpscan.com/vulnerability/d85653f7-8556-4bac-8860-fbacc63ba5df/ technical-descriptionvdb-entryexploit

Affected products

Create

<2.5.4

Matching in nixpkgs

pkgs.create-dmg

Shell script to build fancy DMGs

nixos-unstable 1.2.2
- nixpkgs-unstable 1.2.2
- nixos-unstable-small 1.2.2
nixos-26.05 1.2.2
- nixos-26.05-small 1.2.2
- nixpkgs-26.05-darwin 1.2.2

pkgs.createrepo_c

C implementation of createrepo

nixos-unstable 1.2.3
- nixpkgs-unstable 1.2.3
- nixos-unstable-small 1.2.3
nixos-26.05 1.2.3
- nixos-26.05-small 1.2.3
- nixpkgs-26.05-darwin 1.2.3

pkgs.x-create-mouse-void

Creates an undecorated black window and prevents the mouse from entering that window

nixos-unstable 0.1
- nixpkgs-unstable 0.1
- nixos-unstable-small 0.1
nixos-26.05 0.1
- nixos-26.05-small 0.1
- nixpkgs-26.05-darwin 0.1

pkgs.arduino-create-agent

Agent to upload code to any USB connected Arduino board directly from the browser

nixos-unstable 1.7.0
- nixpkgs-unstable 1.7.0
- nixos-unstable-small 1.7.0
nixos-26.05 1.7.0
- nixos-26.05-small 1.7.0
- nixpkgs-26.05-darwin 1.7.0

pkgs.darwin.linux-builder

Create a Linux builder VM for macOS

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small
nixos-26.05 -
- nixos-26.05-small
- nixpkgs-26.05-darwin

pkgs.darwin.linux-builder-vz

Create a Linux builder VM for macOS

nixos-unstable -
- nixos-unstable-small

pkgs.perlPackages.JSONCreate

Create JSON

nixos-unstable 0.35
- nixpkgs-unstable 0.35
- nixos-unstable-small 0.35
nixos-26.05 0.35
- nixos-26.05-small 0.35
- nixpkgs-26.05-darwin 0.35

pkgs.perl5Packages.JSONCreate

Create JSON

nixos-unstable 0.35
- nixpkgs-unstable 0.35
- nixos-unstable-small 0.35
nixos-26.05 0.35
- nixos-26.05-small 0.35
- nixpkgs-26.05-darwin 0.35

pkgs.darwin.linux-builder-x86_64

None

nixos-unstable -
- nixpkgs-unstable
nixos-26.05 -
- nixos-26.05-small
- nixpkgs-26.05-darwin

pkgs.perlPackages.FileTreeCreate

Recursively create a directory tree

nixos-unstable 0.0.1
- nixpkgs-unstable 0.0.1
- nixos-unstable-small 0.0.1
nixos-26.05 0.0.1
- nixos-26.05-small 0.0.1
- nixpkgs-26.05-darwin 0.0.1

pkgs.perl5Packages.FileTreeCreate

Recursively create a directory tree

nixos-unstable 0.0.1
- nixpkgs-unstable 0.0.1
- nixos-unstable-small 0.0.1
nixos-26.05 0.0.1
- nixos-26.05-small 0.0.1
- nixpkgs-26.05-darwin 0.0.1

pkgs.yaziPlugins.yatline-created-time

An addon to display the creation time of file or folder in your yatline.yazi

nixos-unstable 0-unstable-2025-09-04
- nixpkgs-unstable 0-unstable-2025-09-04
- nixos-unstable-small 0-unstable-2025-09-04

pkgs.haskellPackages.openssl-createkey

Create OpenSSL keypairs

nixos-unstable 0.1
- nixpkgs-unstable 0.1
- nixos-unstable-small 0.1
nixos-26.05 0.1
- nixos-26.05-small 0.1
- nixpkgs-26.05-darwin 0.1

Package maintainers

@kilimnik Daniel Kilimnik <mail@kilimnik.de>
@heywoodlh Spencer Heywood <nixpkgs@heywoodlh.io>
@kpbaks Kristoffer Plagborg Bak Sørensen <kristoffer.pbs@gmail.com>