Nixpkgs security tracker

Dismissed

(no matching packages found)

Permalink CVE-2026-65311

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

Missing authentication for logging-configuration endpoint

The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit logging, potentially concealing other activity on the system.

References

https://www.andritz.com/

Affected products

250 SCALA

==8.00
=<7.20

HIPASE-250

==8.00
=<7.20

Dismissed

(no matching packages found)

Permalink CVE-2026-14930

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.

References

https://wpscan.com/vulnerability/075ca843-e787-43cc-8de4-54d8ddc63d4a/ vdb-entrytechnical-descriptionexploit

Affected products

JS Help Desk

<3.1.4

Dismissed

(no matching packages found)

Permalink CVE-2026-54785

6.2 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1.

References

https://github.com/eLyiN/gemini-bridge/security/advisories/GHSA-c5px-58j2-7fqp x_refsource_CONFIRM
https://github.com/eLyiN/gemini-bridge/pull/9 x_refsource_MISC
https://github.com/eLyiN/gemini-bridge/commit/8f3b85afd02b692c4bc974b5176e12fb277ea801 x_refsource_MISC
https://github.com/eLyiN/gemini-bridge/releases/tag/v1.3.1 x_refsource_MISC

Affected products

gemini-bridge

==>= 1.0.0, < 1.3.1

Dismissed

(no matching packages found)

Permalink CVE-2026-54737

7.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.

References

https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh x_refsource_CONFIRM
https://github.com/phun-ky/defaults-deep/pull/49 x_refsource_MISC
https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059 x_refsource_MISC
https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5 x_refsource_MISC

Affected products

defaults-deep

==< 2.0.5

Dismissed

(no matching packages found)

Permalink CVE-2026-51256

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

None

Affected products

Dismissed

(no matching packages found)

Permalink CVE-2026-28144

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6.

References

https://patchstack.com/database/wordpress/plugin/wp-google-map-plugin/vulnerabi… vdb-entry

Affected products

wp-google-map-plugin

=<4.9.6

Dismissed

(no matching packages found)

Permalink CVE-2025-67651

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

CSRF in PHP Jabbers scripts

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.

References

https://cert.pl/en/posts/2026/07/CVE-2025-67649/ third-party-advisory
https://www.phpjabbers.com/ product

Affected products

Car Rental Script

<4.1

PHP Shopping Cart

<6.0

Job Listing Script

<4.1

PHP Event Calendar

<4.1

Member Login Script

<4.1

Taxi Booking Script

<3.1

Travel Tours Script

<3.1

Food Delivery Script

<4.1

Hotel Booking System

<5.1

Yacht Listing Script

<3.1

Appointment Scheduler

<4.1

Availability Calendar

<6.1

Cinema Booking System

<2.1

Limo Booking Software

<2.1

PHP Newsletter Script

<5.1

Ticket Support Script

<4.1

Bus Reservation System

<2.1

Event Booking Calendar

<5.1

Event Ticketing System

<2.1

Service Booking Script

<2.1

Vacation Rental Script

<5.1

Auto Classifieds Script

<4.1

Car Park Booking System

<4.1

Equipment Rental Script

<2.1

Member Directory Script

<2.1

Property Listing Script

<4.1

Shuttle Booking Software

<3.1

Business Directory Script

<4.1

Product Comparison Script

<2.1

Restaurant Booking System

<4.1

Cleaning Business Software

<2.1

Meeting Room Booking System

<2.1

Time Slots Booking Calendar

<5.1

Availability Booking Calendar

<6.1

Rental Property Booking Calendar

<3.1

Dismissed

(max. allowed matches exceeded)

Permalink CVE-2026-53599

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month ago Activity log

Created & dismissed (max. allowed matches exceeded) suggestion 1 month ago

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.

References

https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25 x_refsource_CONFIRMexploit
https://github.com/redaxo/core/pull/6538 x_refsource_MISC
https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340 x_refsource_MISC
https://github.com/redaxo/core/releases/tag/5.21.1 x_refsource_MISC

Affected products

core

==>= 5.18.2, < 5.21.1

Dismissed

(no matching packages found)

Permalink CVE-2026-56568

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and authentication status

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395

Affected products

HCL iControl

==4.3.0 and 4.4.0

Dismissed

(no matching packages found)

Permalink CVE-2026-51276

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

None

Dismissed suggestions

References

Affected products

References

Affected products

References

Affected products

References

Affected products

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

Affected products