Nixpkgs security tracker

Untriaged

Permalink CVE-2025-62341

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 3 days, 9 hours ago Activity log

Created suggestion 3 days, 9 hours ago

HCL Connections is vulnerable to server-side request forgery (SSRF)

HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass.

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128493

Affected products

Connections

==7.0, 8.0

Matching in nixpkgs

pkgs.gnome-connections

Remote desktop client for the GNOME desktop environment

nixos-unstable 50.0
- nixpkgs-unstable 50.0
- nixos-unstable-small 50.0
nixos-26.05 50.0
- nixos-26.05-small 50.0
- nixpkgs-26.05-darwin 50.0

pkgs.python313Packages.hyper-connections

Module to make multiple residual streams

nixos-unstable 0.4.9
- nixpkgs-unstable 0.4.9
- nixos-unstable-small 0.4.9
nixos-26.05 0.4.9
- nixos-26.05-small 0.4.9
- nixpkgs-26.05-darwin 0.4.9

pkgs.python314Packages.hyper-connections

Module to make multiple residual streams

nixos-unstable 0.4.9
- nixpkgs-unstable 0.4.9
- nixos-unstable-small 0.4.9
nixos-26.05 0.4.9
- nixos-26.05-small 0.4.9
- nixpkgs-26.05-darwin 0.4.9

pkgs.sbclPackages.asdf-system-connections

None

nixos-unstable 20170124-git
- nixpkgs-unstable 20170124-git
- nixos-unstable-small 20170124-git
nixos-26.05 20170124-git
- nixos-26.05-small 20170124-git
- nixpkgs-26.05-darwin 20170124-git

pkgs.pkgsRocm.python3Packages.hyper-connections

Module to make multiple residual streams

nixos-unstable 0.4.9
- nixpkgs-unstable 0.4.9
- nixos-unstable-small 0.4.9
nixos-26.05 0.4.9
- nixos-26.05-small 0.4.9
- nixpkgs-26.05-darwin 0.4.9

pkgs.haskellPackages.amazonka-codestar-connections

Amazon CodeStar connections SDK

nixos-unstable 2.0-unstable-2025-04-16
- nixpkgs-unstable 2.0-unstable-2025-04-16
- nixos-unstable-small 2.0-unstable-2025-04-16
nixos-26.05 2.0-unstable-2025-04-16
- nixos-26.05-small 2.0-unstable-2025-04-16
- nixpkgs-26.05-darwin 2.0-unstable-2025-04-16

pkgs.python313Packages.mypy-boto3-codestar-connections

Type annotations for boto3 codestar-connections

nixos-unstable 1.43.0
- nixpkgs-unstable 1.43.0
- nixos-unstable-small 1.43.0
nixos-26.05 1.43.0
- nixos-26.05-small 1.43.0
- nixpkgs-26.05-darwin 1.43.0

pkgs.python314Packages.mypy-boto3-codestar-connections

Type annotations for boto3 codestar-connections

nixos-unstable 1.43.0
- nixpkgs-unstable 1.43.0
- nixos-unstable-small 1.43.0
nixos-26.05 1.43.0
- nixos-26.05-small 1.43.0
- nixpkgs-26.05-darwin 1.43.0

pkgs.python313Packages.types-aiobotocore-codeconnections

Type annotations for aiobotocore codeconnections

nixos-unstable 3.7.0
- nixpkgs-unstable 3.7.0
- nixos-unstable-small 3.9.0
nixos-26.05 3.7.0
- nixos-26.05-small 3.7.0
- nixpkgs-26.05-darwin 3.7.0

pkgs.python314Packages.types-aiobotocore-codeconnections

Type annotations for aiobotocore codeconnections

nixos-unstable -
- nixos-unstable-small 3.9.0

pkgs.python313Packages.types-aiobotocore-codestar-connections

Type annotations for aiobotocore codestar-connections

nixos-unstable 3.7.0
- nixpkgs-unstable 3.7.0
- nixos-unstable-small 3.9.0
nixos-26.05 3.7.0
- nixos-26.05-small 3.7.0
- nixpkgs-26.05-darwin 3.7.0

pkgs.python314Packages.types-aiobotocore-codestar-connections

Type annotations for aiobotocore codestar-connections

nixos-unstable -
- nixos-unstable-small 3.9.0

Package maintainers

@nekowinston winston <hey@winston.sh>
@jtojnar Jan Tojnar <jtojnar@gmail.com>
@bobby285271 Bobby Rong <rjl931189261@126.com>
@theCapypara Marco Köpcke <hello@capypara.de>
@thunze Tom Hunze
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@lukego Luke Gorrie <luke@snabb.co>
@Uthar Kasper Gałkowski <galkowskikasper@gmail.com>
@7c6f434c Michael Raskin <7c6f434c@mail.ru>
@nagy Daniel Nagy <danielnagy@posteo.de>
@hraban Hraban Luyat <hraban@0brg.net>

Untriaged

Permalink CVE-2026-56537

3.5 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created suggestion 1 month ago

HCL Connections is vulnerable to information disclosure

HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.they are not entitled to, caused by improper handling of request data.

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132507

Affected products

Connections

==8.0

Matching in nixpkgs

pkgs.gnome-connections

Remote desktop client for the GNOME desktop environment

nixos-unstable -
- nixos-unstable-small 50.0
nixos-26.05 -
- nixos-26.05-small 50.0

pkgs.python313Packages.hyper-connections

Module to make multiple residual streams

nixos-unstable -
- nixos-unstable-small 0.4.9
nixos-26.05 -
- nixos-26.05-small 0.4.9

pkgs.python314Packages.hyper-connections

Module to make multiple residual streams

nixos-unstable -
- nixos-unstable-small 0.4.9
nixos-26.05 -
- nixos-26.05-small 0.4.9

pkgs.sbclPackages.asdf-system-connections

None

nixos-unstable -
- nixos-unstable-small 20170124-git
nixos-26.05 -
- nixos-26.05-small 20170124-git

pkgs.pkgsRocm.python3Packages.hyper-connections

Module to make multiple residual streams

nixos-unstable -
- nixos-unstable-small 0.4.9
nixos-26.05 -
- nixos-26.05-small 0.4.9

pkgs.haskellPackages.amazonka-codestar-connections

Amazon CodeStar connections SDK

nixos-unstable -
- nixos-unstable-small 2.0-unstable-2025-04-16
nixos-26.05 -
- nixos-26.05-small 2.0-unstable-2025-04-16

pkgs.python313Packages.mypy-boto3-codestar-connections

Type annotations for boto3 codestar-connections

nixos-unstable -
- nixos-unstable-small 1.43.0
nixos-26.05 -
- nixos-26.05-small 1.43.0

pkgs.python314Packages.mypy-boto3-codestar-connections

Type annotations for boto3 codestar-connections

nixos-unstable -
- nixos-unstable-small 1.43.0
nixos-26.05 -
- nixos-26.05-small 1.43.0

pkgs.python313Packages.types-aiobotocore-codeconnections

Type annotations for aiobotocore codeconnections

nixos-unstable -
- nixos-unstable-small 3.7.0
nixos-26.05 -
- nixos-26.05-small 3.7.0

pkgs.python314Packages.types-aiobotocore-codeconnections

Type annotations for aiobotocore codeconnections

nixos-unstable -
- nixos-unstable-small 3.7.0

pkgs.python313Packages.types-aiobotocore-codestar-connections

Type annotations for aiobotocore codestar-connections

nixos-unstable -
- nixos-unstable-small 3.7.0
nixos-26.05 -
- nixos-26.05-small 3.7.0

pkgs.python314Packages.types-aiobotocore-codestar-connections

Type annotations for aiobotocore codestar-connections

nixos-unstable -
- nixos-unstable-small 3.7.0

Package maintainers

@bobby285271 Bobby Rong <rjl931189261@126.com>
@jtojnar Jan Tojnar <jtojnar@gmail.com>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@nagy Daniel Nagy <danielnagy@posteo.de>
@7c6f434c Michael Raskin <7c6f434c@mail.ru>
@Uthar Kasper Gałkowski <galkowskikasper@gmail.com>
@hraban Hraban Luyat <hraban@0brg.net>
@lukego Luke Gorrie <luke@snabb.co>

Untriaged

Permalink CVE-2026-56538

3.5 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created suggestion 1 month ago

HCL Connections is vulnerable to information disclosure

An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users.