Nixpkgs security tracker

Untriaged

Permalink CVE-2026-55852

8.6 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 4 days, 8 hours ago Activity log

Created suggestion 4 days, 8 hours ago

Frappe: TarSlip RCE in Package Import

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.

References

https://github.com/frappe/frappe/security/advisories/GHSA-58w2-4cjg-hvp6 x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/38716 x_refsource_MISC
https://github.com/frappe/frappe/pull/40044 x_refsource_MISC
https://github.com/frappe/frappe/pull/40045 x_refsource_MISC
https://github.com/frappe/frappe/commit/3c75f13fd7d4441a880dd236450277dc37fcddfd x_refsource_MISC
https://github.com/frappe/frappe/commit/4772e3e7f72db43d48137af74fa77e5fce903223 x_refsource_MISC
https://github.com/frappe/frappe/commit/57e527d933aeffaec0cd735838701792c848e3e7 x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v15.112.0 x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v16.23.0 x_refsource_MISC

Affected products

frappe

==>= 16.0.0-beta.1, < 16.23.0
==< 15.112.0

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

Catppuccin Frappé colorscheme wallpaper for NixOS

nixos-unstable 2024-02-15
- nixpkgs-unstable 2024-02-15
- nixos-unstable-small 2024-02-15
nixos-26.05 2024-02-15
- nixos-26.05-small 2024-02-15
- nixpkgs-26.05-darwin 2024-02-15

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

Alternative Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

Untriaged

Permalink CVE-2026-49394

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 4 days, 8 hours ago Activity log

Created suggestion 4 days, 8 hours ago

Frappe: Auth. bypass via update_page

Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public workspaces did not receive the required Workspace Manager edit check. This issue is fixed in version 16.19.0.

References

https://github.com/frappe/frappe/security/advisories/GHSA-r24j-xrj8-273q x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/39508 x_refsource_MISC
https://github.com/frappe/frappe/pull/39526 x_refsource_MISC
https://github.com/frappe/frappe/commit/2471d94c397dc23301b30ed3bb30353f53b33f2c x_refsource_MISC
https://github.com/frappe/frappe/commit/6eba29d7ae80cdb4d0b2a245a477b1d2312736ca x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v16.19.0 x_refsource_MISC

Affected products

frappe

==< 16.19.0

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

Catppuccin Frappé colorscheme wallpaper for NixOS

nixos-unstable 2024-02-15
- nixpkgs-unstable 2024-02-15
- nixos-unstable-small 2024-02-15
nixos-26.05 2024-02-15
- nixos-26.05-small 2024-02-15
- nixpkgs-26.05-darwin 2024-02-15

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

Alternative Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

Untriaged

Permalink CVE-2026-42219

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 4 days, 8 hours ago Activity log

Created suggestion 4 days, 8 hours ago

Frappe: Path Traversal via /backups Route

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.

References

https://github.com/frappe/frappe/security/advisories/GHSA-w4p4-fp9m-47gj x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/38740 x_refsource_MISC
https://github.com/frappe/frappe/pull/39402 x_refsource_MISC
https://github.com/frappe/frappe/pull/39403 x_refsource_MISC
https://github.com/frappe/frappe/commit/4358f5bd449710027724a1679950d4ea65da6dcc x_refsource_MISC
https://github.com/frappe/frappe/commit/a470a1189132984635e2ec148f87de5232f5535d x_refsource_MISC
https://github.com/frappe/frappe/commit/a562ef2a5a3885895b9f9cf14d5a53e32e52d326 x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v15.109.0 x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v16.19.0 x_refsource_MISC

Affected products

frappe

==< 15.109.0
==>= 16.0.0-beta.1, < 16.19.0

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

Catppuccin Frappé colorscheme wallpaper for NixOS

nixos-unstable 2024-02-15
- nixpkgs-unstable 2024-02-15
- nixos-unstable-small 2024-02-15
nixos-26.05 2024-02-15
- nixos-26.05-small 2024-02-15
- nixpkgs-26.05-darwin 2024-02-15

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

Alternative Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

Untriaged

Permalink CVE-2026-47199

2.3 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 4 days, 8 hours ago Activity log

Created suggestion 4 days, 8 hours ago

Frappe: check_safe_sql_query Permits SELECT INTO OUTFILE

Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potentially work on self-hosted sites if database permissions are not well aligned and MySQL FILE privileges are available. This issue is fixed in versions 16.18.3 and 15.108.0.

References

https://github.com/frappe/frappe/security/advisories/GHSA-wx8j-cw4r-vrhv x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/39345 x_refsource_MISC
https://github.com/frappe/frappe/pull/39346 x_refsource_MISC
https://github.com/frappe/frappe/commit/628e103f7ffe307447d9fc9e2c572cbddedfa3b5 x_refsource_MISC
https://github.com/frappe/frappe/commit/91d3ded038d1c901b73f4a2293e134d691c1662d x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v15.108.0 x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v16.18.3 x_refsource_MISC

Affected products

frappe

==< 15.108.0
==>= 16.0.0-beta.1, < 16.18.3

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

Catppuccin Frappé colorscheme wallpaper for NixOS

nixos-unstable 2024-02-15
- nixpkgs-unstable 2024-02-15
- nixos-unstable-small 2024-02-15
nixos-26.05 2024-02-15
- nixos-26.05-small 2024-02-15
- nixpkgs-26.05-darwin 2024-02-15

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

Alternative Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

Untriaged

Permalink CVE-2026-47422

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 4 days, 8 hours ago Activity log

Created suggestion 4 days, 8 hours ago

Frappe: Unrestricted API access to save_report

Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.

References

https://github.com/frappe/frappe/security/advisories/GHSA-w8g7-j846-j248 x_refsource_CONFIRM

Affected products

frappe

==< 15.107.5
==>= 16.0.0-beta.1, < 6.18.2

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

Catppuccin Frappé colorscheme wallpaper for NixOS

nixos-unstable 2024-02-15
- nixpkgs-unstable 2024-02-15
- nixos-unstable-small 2024-02-15
nixos-26.05 2024-02-15
- nixos-26.05-small 2024-02-15
- nixpkgs-26.05-darwin 2024-02-15

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

Alternative Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

Untriaged

Permalink CVE-2026-41482

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 4 days, 8 hours ago Activity log

Created suggestion 4 days, 8 hours ago

Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator

Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.

References

https://github.com/frappe/frappe/security/advisories/GHSA-234v-jfr8-v2f8 x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/38643 x_refsource_MISC
https://github.com/frappe/frappe/pull/39396 x_refsource_MISC
https://github.com/frappe/frappe/commit/11066591ed7aa91a7b742f3f689277a90e620ce0 x_refsource_MISC
https://github.com/frappe/frappe/commit/46841f7fde3954e1d3b3a7e248a6d6022343e657 x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v16.18.3 x_refsource_MISC

Affected products

frappe

==< 16.18.3

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

Catppuccin Frappé colorscheme wallpaper for NixOS

nixos-unstable 2024-02-15
- nixpkgs-unstable 2024-02-15
- nixos-unstable-small 2024-02-15
nixos-26.05 2024-02-15
- nixos-26.05-small 2024-02-15
- nixpkgs-26.05-darwin 2024-02-15

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

Alternative Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

Untriaged

Permalink CVE-2026-48127

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 4 days, 8 hours ago Activity log

Created suggestion 4 days, 8 hours ago

Frappe: Arbitrary Attachment Injection via add_attachments and upload_file

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-handling API endpoints such as add_attachments. This issue is fixed in versions 16.20.0 and 15.110.0.

References

https://github.com/frappe/frappe/security/advisories/GHSA-fwrv-4rw4-97fw x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/39407 x_refsource_MISC
https://github.com/frappe/frappe/pull/39550 x_refsource_MISC
https://github.com/frappe/frappe/pull/39553 x_refsource_MISC
https://github.com/frappe/frappe/commit/4bf27db101c34bd542a760290fc0775efa5cd0e4 x_refsource_MISC
https://github.com/frappe/frappe/commit/b1c86042e6f85986f35365c80bb1d102ff1cd0e4 x_refsource_MISC
https://github.com/frappe/frappe/commit/fee1af6d89910f6b174fd094184060aeb641d07d x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v15.110.0 x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v16.20.0 x_refsource_MISC

Affected products

frappe

==< 15.110.0
==>= 16.0.0-beta.1, < 16.20.0

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

Catppuccin Frappé colorscheme wallpaper for NixOS

nixos-unstable 2024-02-15
- nixpkgs-unstable 2024-02-15
- nixos-unstable-small 2024-02-15
nixos-26.05 2024-02-15
- nixos-26.05-small 2024-02-15
- nixpkgs-26.05-darwin 2024-02-15

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

Alternative Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

Untriaged

Permalink CVE-2026-58503

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 4 days, 8 hours ago Activity log

Created suggestion 4 days, 8 hours ago

Frappe: Unauthenticated User Enumeration via reset_password

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issue is fixed in versions 16.16.0 and 15.106.0.

References

https://github.com/frappe/frappe/security/advisories/GHSA-3vqc-c545-w7jg x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/38625 x_refsource_MISC
https://github.com/frappe/frappe/pull/38626 x_refsource_MISC
https://github.com/frappe/frappe/commit/1ff64d4a67f9a6d8819ac059dc69f023fb9ea264 x_refsource_MISC
https://github.com/frappe/frappe/commit/d3becf5672cbb5c7150447161941aeebeeb84ae8 x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v15.106.0 x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v16.16.0 x_refsource_MISC

Affected products

frappe

==< 15.106.0
==>= 16.0.0-beta1, < 16.16.0

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

Catppuccin Frappé colorscheme wallpaper for NixOS

nixos-unstable 2024-02-15
- nixpkgs-unstable 2024-02-15
- nixos-unstable-small 2024-02-15
nixos-26.05 2024-02-15
- nixos-26.05-small 2024-02-15
- nixpkgs-26.05-darwin 2024-02-15

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

Alternative Catppuccin Frappe wallpaper for Nix inspired by simpler times

nixos-unstable 2025-01-27
- nixpkgs-unstable 2025-01-27
- nixos-unstable-small 2025-01-27
nixos-26.05 2025-01-27
- nixos-26.05-small 2025-01-27
- nixpkgs-26.05-darwin 2025-01-27

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

References

Affected products

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

References

Affected products

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

References

Affected products

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

References

Affected products

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

References

Affected products

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

References

Affected products

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt

References

Affected products

Matching in nixpkgs

pkgs.nixos-artwork.wallpapers.catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe

pkgs.nixos-artwork.wallpapers.nineish-catppuccin-frappe-alt