Nixpkgs security tracker

Untriaged

Permalink CVE-2026-22399

created 1 month, 1 week ago

WordPress Holmes theme <= 1.7 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Holmes holmes allows PHP Local File Inclusion.This issue affects Holmes: from n/a through <= 1.7.

References

https://patchstack.com/database/Wordpress/Theme/holmes/vulnerability/wordpress-… vdb-entry

Affected products

holmes

=<<= 1.7

Matching in nixpkgs

pkgs.rubyPackages.charlock_holmes

None

nixos-unstable 0.7.9
- nixpkgs-unstable 0.7.9
- nixos-unstable-small 0.7.9
nixos-25.11 0.7.9
- nixos-25.11-small 0.7.9
- nixpkgs-25.11-darwin 0.7.9

pkgs.rubyPackages_3_1.charlock_holmes

None

pkgs.rubyPackages_3_2.charlock_holmes

None

pkgs.rubyPackages_3_3.charlock_holmes

None

nixos-unstable 0.7.9
- nixpkgs-unstable 0.7.9
- nixos-unstable-small 0.7.9
nixos-25.11 0.7.9
- nixos-25.11-small 0.7.9
- nixpkgs-25.11-darwin 0.7.9

pkgs.rubyPackages_3_4.charlock_holmes

None

nixos-unstable 0.7.9
- nixpkgs-unstable 0.7.9
- nixos-unstable-small 0.7.9
nixos-25.11 0.7.9
- nixos-25.11-small 0.7.9
- nixpkgs-25.11-darwin 0.7.9

pkgs.rubyPackages_4_0.charlock_holmes

None

nixos-unstable 0.7.9
- nixpkgs-unstable 0.7.9
- nixos-unstable-small 0.7.9
nixos-25.11 0.7.9
- nixos-25.11-small 0.7.9
- nixpkgs-25.11-darwin 0.7.9

Untriaged

Permalink CVE-2026-22400

5.4 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): LOW
Integrity impact (I): LOW
Availability impact (A): NONE

created 2 months, 3 weeks ago

WordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Holmes: from n/a through <= 1.7.