Suggestions search

Untriaged

Filter by:

With package: x-create-mouse-void

Found 3 matching suggestions

View:

Compact

Detailed

Permalink CVE-2026-18037

created 3 weeks ago Activity log

Created suggestion 3 weeks ago

Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.

References

https://wpscan.com/vulnerability/cd61ce2a-94ce-4ce3-a592-b7329f118f94/ technical-descriptionvdb-entryexploit

Affected products

Create

<2.5.4

Matching in nixpkgs

pkgs.create-dmg

Shell script to build fancy DMGs

nixos-unstable 1.2.2
- nixpkgs-unstable 1.2.2
- nixos-unstable-small 1.2.2
nixos-26.05 1.2.2
- nixos-26.05-small 1.2.2
- nixpkgs-26.05-darwin 1.2.2

pkgs.createrepo_c

C implementation of createrepo

nixos-unstable 1.2.3
- nixpkgs-unstable 1.2.3
- nixos-unstable-small 1.2.3
nixos-26.05 1.2.3
- nixos-26.05-small 1.2.3
- nixpkgs-26.05-darwin 1.2.3

pkgs.x-create-mouse-void

Creates an undecorated black window and prevents the mouse from entering that window

nixos-unstable 0.1
- nixpkgs-unstable 0.1
- nixos-unstable-small 0.1
nixos-26.05 0.1
- nixos-26.05-small 0.1
- nixpkgs-26.05-darwin 0.1

pkgs.arduino-create-agent

Agent to upload code to any USB connected Arduino board directly from the browser

nixos-unstable 1.7.0
- nixpkgs-unstable 1.7.0
- nixos-unstable-small 1.7.0
nixos-26.05 1.7.0
- nixos-26.05-small 1.7.0
- nixpkgs-26.05-darwin 1.7.0

pkgs.darwin.linux-builder

Create a Linux builder VM for macOS

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small
nixos-26.05 -
- nixos-26.05-small
- nixpkgs-26.05-darwin

pkgs.darwin.linux-builder-vz

Create a Linux builder VM for macOS

nixos-unstable -
- nixos-unstable-small

pkgs.perlPackages.JSONCreate

Create JSON

nixos-unstable 0.35
- nixpkgs-unstable 0.35
- nixos-unstable-small 0.35
nixos-26.05 0.35
- nixos-26.05-small 0.35
- nixpkgs-26.05-darwin 0.35

pkgs.perl5Packages.JSONCreate

Create JSON

nixos-unstable 0.35
- nixpkgs-unstable 0.35
- nixos-unstable-small 0.35
nixos-26.05 0.35
- nixos-26.05-small 0.35
- nixpkgs-26.05-darwin 0.35

pkgs.darwin.linux-builder-x86_64

None

nixos-unstable -
- nixpkgs-unstable
nixos-26.05 -
- nixos-26.05-small
- nixpkgs-26.05-darwin

pkgs.perlPackages.FileTreeCreate

Recursively create a directory tree

nixos-unstable 0.0.1
- nixpkgs-unstable 0.0.1
- nixos-unstable-small 0.0.1
nixos-26.05 0.0.1
- nixos-26.05-small 0.0.1
- nixpkgs-26.05-darwin 0.0.1

pkgs.perl5Packages.FileTreeCreate

Recursively create a directory tree

nixos-unstable 0.0.1
- nixpkgs-unstable 0.0.1
- nixos-unstable-small 0.0.1
nixos-26.05 0.0.1
- nixos-26.05-small 0.0.1
- nixpkgs-26.05-darwin 0.0.1

pkgs.yaziPlugins.yatline-created-time

An addon to display the creation time of file or folder in your yatline.yazi

nixos-unstable 0-unstable-2025-09-04
- nixpkgs-unstable 0-unstable-2025-09-04
- nixos-unstable-small 0-unstable-2025-09-04

pkgs.haskellPackages.openssl-createkey

Create OpenSSL keypairs

nixos-unstable 0.1
- nixpkgs-unstable 0.1
- nixos-unstable-small 0.1
nixos-26.05 0.1
- nixos-26.05-small 0.1
- nixpkgs-26.05-darwin 0.1

Package maintainers

@kilimnik Daniel Kilimnik <mail@kilimnik.de>
@heywoodlh Spencer Heywood <nixpkgs@heywoodlh.io>
@kpbaks Kristoffer Plagborg Bak Sørensen <kristoffer.pbs@gmail.com>

Permalink CVE-2026-16992

created 3 weeks ago Activity log

Created suggestion 3 weeks ago

Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.

References

https://wpscan.com/vulnerability/d85653f7-8556-4bac-8860-fbacc63ba5df/ technical-descriptionvdb-entryexploit

Affected products

Create

<2.5.4

Matching in nixpkgs

pkgs.create-dmg

Shell script to build fancy DMGs

nixos-unstable 1.2.2
- nixpkgs-unstable 1.2.2
- nixos-unstable-small 1.2.2
nixos-26.05 1.2.2
- nixos-26.05-small 1.2.2
- nixpkgs-26.05-darwin 1.2.2

pkgs.createrepo_c

C implementation of createrepo

nixos-unstable 1.2.3
- nixpkgs-unstable 1.2.3
- nixos-unstable-small 1.2.3
nixos-26.05 1.2.3
- nixos-26.05-small 1.2.3
- nixpkgs-26.05-darwin 1.2.3

pkgs.x-create-mouse-void

Creates an undecorated black window and prevents the mouse from entering that window

nixos-unstable 0.1
- nixpkgs-unstable 0.1
- nixos-unstable-small 0.1
nixos-26.05 0.1
- nixos-26.05-small 0.1
- nixpkgs-26.05-darwin 0.1

pkgs.arduino-create-agent

Agent to upload code to any USB connected Arduino board directly from the browser

nixos-unstable 1.7.0
- nixpkgs-unstable 1.7.0
- nixos-unstable-small 1.7.0
nixos-26.05 1.7.0
- nixos-26.05-small 1.7.0
- nixpkgs-26.05-darwin 1.7.0

pkgs.darwin.linux-builder

Create a Linux builder VM for macOS

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small
nixos-26.05 -
- nixos-26.05-small
- nixpkgs-26.05-darwin

pkgs.darwin.linux-builder-vz

Create a Linux builder VM for macOS

nixos-unstable -
- nixos-unstable-small

pkgs.perlPackages.JSONCreate

Create JSON

nixos-unstable 0.35
- nixpkgs-unstable 0.35
- nixos-unstable-small 0.35
nixos-26.05 0.35
- nixos-26.05-small 0.35
- nixpkgs-26.05-darwin 0.35

pkgs.perl5Packages.JSONCreate

Create JSON

nixos-unstable 0.35
- nixpkgs-unstable 0.35
- nixos-unstable-small 0.35
nixos-26.05 0.35
- nixos-26.05-small 0.35
- nixpkgs-26.05-darwin 0.35

pkgs.darwin.linux-builder-x86_64

None

nixos-unstable -
- nixpkgs-unstable
nixos-26.05 -
- nixos-26.05-small
- nixpkgs-26.05-darwin

pkgs.perlPackages.FileTreeCreate

Recursively create a directory tree

nixos-unstable 0.0.1
- nixpkgs-unstable 0.0.1
- nixos-unstable-small 0.0.1
nixos-26.05 0.0.1
- nixos-26.05-small 0.0.1
- nixpkgs-26.05-darwin 0.0.1

pkgs.perl5Packages.FileTreeCreate

Recursively create a directory tree

nixos-unstable 0.0.1
- nixpkgs-unstable 0.0.1
- nixos-unstable-small 0.0.1
nixos-26.05 0.0.1
- nixos-26.05-small 0.0.1
- nixpkgs-26.05-darwin 0.0.1

pkgs.yaziPlugins.yatline-created-time

An addon to display the creation time of file or folder in your yatline.yazi

nixos-unstable 0-unstable-2025-09-04
- nixpkgs-unstable 0-unstable-2025-09-04
- nixos-unstable-small 0-unstable-2025-09-04

pkgs.haskellPackages.openssl-createkey

Create OpenSSL keypairs

nixos-unstable 0.1
- nixpkgs-unstable 0.1
- nixos-unstable-small 0.1
nixos-26.05 0.1
- nixos-26.05-small 0.1
- nixpkgs-26.05-darwin 0.1

Package maintainers

@kilimnik Daniel Kilimnik <mail@kilimnik.de>
@heywoodlh Spencer Heywood <nixpkgs@heywoodlh.io>
@kpbaks Kristoffer Plagborg Bak Sørensen <kristoffer.pbs@gmail.com>

Permalink CVE-2026-65698

6.0 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

Void 1.3.4 Path Traversal via AI Agent File-Reading Tools

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file:// URIs through the read_file, ls_dir, get_dir_tree, and search_* tools, which lack workspace confinement and bypass the approval gate, enabling silent exfiltration of sensitive files such as SSH private keys or cloud credentials via subsequent tool calls.