Nixpkgs security tracker

Permalink CVE-2025-23987

6.5 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality impact (C): LOW
Integrity impact (I): LOW
Availability impact (A): LOW

updated 1 year, 2 months ago by @fricklerhandwerk Activity log

Created automatic suggestion 1 year, 2 months ago
@fricklerhandwerk dismissed 1 year, 2 months ago

WordPress Designer plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodegearThemes Designer allows DOM-Based XSS. This issue affects Designer: from n/a through 1.6.0.

References

Affected products

designer

=<1.6.0

Matching in nixpkgs

pkgs.libsForQt5.kdesignerplugin

None

nixos-unstable 5.116.0
- nixpkgs-unstable 5.116.0
- nixos-unstable-small 5.116.0

pkgs.plasma5Packages.kdesignerplugin

None

nixos-unstable 5.116.0
- nixpkgs-unstable 5.116.0
- nixos-unstable-small 5.116.0

Package maintainers

@ttuegel Thomas Tuegel <ttuegel@mailbox.org>
@nyanloutre Paul Trehiou <paul@nyanlout.re>

Permalink CVE-2023-1786

5.5 MEDIUM

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): NONE
Availability impact (A): NONE

updated 1 year, 2 months ago by @fricklerhandwerk Activity log

Created automatic suggestion 1 year, 2 months ago
@fricklerhandwerk dismissed 1 year, 2 months ago

sensitive data exposure in cloud-init logs

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.

References

https://github.com/canonical/cloud-init/commit/a378b7e4f47375458651c0972e7cd813… patch
https://bugs.launchpad.net/cloud-init/+bug/2013967 issue-tracking
https://ubuntu.com/security/notices/USN-6042-1 vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj…
https://github.com/canonical/cloud-init/commit/a378b7e4f47375458651c0972e7cd813… patchx_transferred
https://bugs.launchpad.net/cloud-init/+bug/2013967 issue-trackingx_transferred
https://ubuntu.com/security/notices/USN-6042-1 vendor-advisoryx_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj… x_transferred
https://github.com/canonical/cloud-init/commit/a378b7e4f47375458651c0972e7cd813… patch
https://bugs.launchpad.net/cloud-init/+bug/2013967 issue-tracking
https://ubuntu.com/security/notices/USN-6042-1 vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj…
https://github.com/canonical/cloud-init/commit/a378b7e4f47375458651c0972e7cd813… patchx_transferred
https://bugs.launchpad.net/cloud-init/+bug/2013967 issue-trackingx_transferred
https://ubuntu.com/security/notices/USN-6042-1 vendor-advisoryx_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj… x_transferred
https://github.com/canonical/cloud-init/commit/a378b7e4f47375458651c0972e7cd813… patch
https://bugs.launchpad.net/cloud-init/+bug/2013967 issue-tracking
https://ubuntu.com/security/notices/USN-6042-1 vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj…
https://github.com/canonical/cloud-init/commit/a378b7e4f47375458651c0972e7cd813… patchx_transferred
https://bugs.launchpad.net/cloud-init/+bug/2013967 issue-trackingx_transferred
https://ubuntu.com/security/notices/USN-6042-1 vendor-advisoryx_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj… x_transferred
https://github.com/canonical/cloud-init/commit/a378b7e4f47375458651c0972e7cd813… patch
https://bugs.launchpad.net/cloud-init/+bug/2013967 issue-tracking
https://ubuntu.com/security/notices/USN-6042-1 vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj…
https://github.com/canonical/cloud-init/commit/a378b7e4f47375458651c0972e7cd813… patchx_transferred
https://bugs.launchpad.net/cloud-init/+bug/2013967 issue-trackingx_transferred
https://ubuntu.com/security/notices/USN-6042-1 vendor-advisoryx_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj… x_transferred

Affected products

cloud-init

<23.1.2

Matching in nixpkgs

pkgs.cloud-init

Provides configuration and customization of cloud instance

nixos-unstable 24.2
- nixpkgs-unstable 24.2
- nixos-unstable-small 24.2

Package maintainers

@jfroche Jean-François Roche <jfroche@pyxel.be>
@illustris Harikrishnan R <me@illustris.tech>

Permalink CVE-2020-11936

3.1 LOW

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): HIGH
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): LOW
Integrity impact (I): NONE
Availability impact (A): NONE

updated 1 year, 2 months ago by @fricklerhandwerk Activity log

Created automatic suggestion 1 year, 2 months ago
@fricklerhandwerk dismissed 1 year, 2 months ago

gdbus setgid privilege escalation

References

https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1885633 issue-tracking
https://www.cve.org/CVERecord?id=CVE-2020-11936 issue-tracking
https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1885633 issue-tracking
https://www.cve.org/CVERecord?id=CVE-2020-11936 issue-tracking

Affected products

apport

<2.20.11-0ubuntu27.6

Matching in nixpkgs

pkgs.haskellPackages.apportionment

Round a set of numbers while maintaining its sum

nixos-unstable 0.0.0.4
- nixpkgs-unstable 0.0.0.4
- nixos-unstable-small 0.0.0.4

Package maintainers

@thielema Henning Thielemann <nix@henning-thielemann.de>

Permalink CVE-2023-0092

4.9 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): HIGH
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): NONE
Availability impact (A): NONE

updated 1 year, 2 months ago by @fricklerhandwerk Activity log

Created automatic suggestion 1 year, 2 months ago
@fricklerhandwerk dismissed 1 year, 2 months ago

An authenticated user who has read access to the juju …

An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.

References

https://github.com/advisories/GHSA-x5rv-w9pm-8qp8 issue-tracking
https://github.com/juju/juju/commit/ef803e2a13692d355b784b7da8b4b1f01dab1556 patch
https://github.com/advisories/GHSA-x5rv-w9pm-8qp8 issue-tracking
https://github.com/juju/juju/commit/ef803e2a13692d355b784b7da8b4b1f01dab1556 patch

Affected products

juju

<3.0.3
<2.9.38

Matching in nixpkgs

pkgs.juju

Open source modelling tool for operating software in the cloud

nixos-unstable 3.5.4
- nixpkgs-unstable 3.5.4
- nixos-unstable-small 3.5.4

Package maintainers

@RealityAnomaly Alex Zero <alex@arctarus.co.uk>

Permalink CVE-2022-28653

7.5 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): NONE
Availability impact (A): HIGH

updated 1 year, 2 months ago by @fricklerhandwerk Activity log

Created automatic suggestion 1 year, 2 months ago
@fricklerhandwerk dismissed 1 year, 2 months ago

Users can consume unlimited disk space in /var/crash

References

https://www.cve.org/CVERecord?id=CVE-2022-28653 issue-tracking
https://www.cve.org/CVERecord?id=CVE-2022-28653 issue-tracking

Affected products

apport

<2.21.0

Matching in nixpkgs

pkgs.haskellPackages.apportionment

Round a set of numbers while maintaining its sum

nixos-unstable 0.0.0.4
- nixpkgs-unstable 0.0.0.4
- nixos-unstable-small 0.0.0.4

Package maintainers

@thielema Henning Thielemann <nix@henning-thielemann.de>

Permalink CVE-2025-23684

4.3 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): LOW
Integrity impact (I): NONE
Availability impact (A): NONE

updated 1 year, 2 months ago by @fricklerhandwerk Activity log

Created automatic suggestion 1 year, 2 months ago
@fricklerhandwerk dismissed 1 year, 2 months ago

WordPress Debug Tool plugin <= 2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Eugen Bobrowski Debug Tool allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Debug Tool: from n/a through 2.2.

References

Affected products

debug-tool

=<2.2

Matching in nixpkgs

Package maintainers

@yuuyins Yuu Yin <yuunix@grrlz.net>
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>

Permalink CVE-2025-23886

6.5 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality impact (C): LOW
Integrity impact (I): LOW
Availability impact (A): LOW

updated 1 year, 2 months ago by @Erethon Activity log

Created automatic suggestion 1 year, 2 months ago
@Erethon accepted 1 year, 2 months ago
@Erethon dismissed 1 year, 2 months ago

WordPress Annie plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Roberts Annie allows Stored XSS.This issue affects Annie: from n/a through 2.1.1.

References

Affected products

annie

=<2.1.1

Matching in nixpkgs

pkgs.wannier90

Calculation of maximally localised Wannier functions

nixos-unstable 3.1.0
- nixpkgs-unstable 3.1.0
- nixos-unstable-small 3.1.0

Package maintainers

@sheepforce Phillip Seeber <phillip.seeber@googlemail.com>

Permalink CVE-2025-23892

6.5 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality impact (C): LOW
Integrity impact (I): LOW
Availability impact (A): LOW

updated 1 year, 2 months ago by @Erethon Activity log

Created automatic suggestion 1 year, 2 months ago
@Erethon accepted 1 year, 2 months ago
@Erethon dismissed 1 year, 2 months ago

WordPress Progress Tracker plugin <= 0.9.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Furr and Simon Ward Progress Tracker allows DOM-Based XSS.This issue affects Progress Tracker: from n/a through 0.9.3.

References

Affected products

progress-tracker

=<0.9.3

Matching in nixpkgs

pkgs.progress-tracker

Simple kanban-style task organiser

nixos-unstable 1.6
- nixpkgs-unstable 1.6
- nixos-unstable-small 1.6

Package maintainers

@Guanran928 Guanran Wang <guanran928@outlook.com>

Permalink CVE-2022-45836

7.1 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality impact (C): LOW
Integrity impact (I): LOW
Availability impact (A): LOW

updated 1 year, 2 months ago by @Erethon Activity log

Created automatic suggestion 1 year, 3 months ago
@Erethon accepted 1 year, 2 months ago
@Erethon dismissed 1 year, 2 months ago
@Erethon accepted 1 year, 2 months ago
@Erethon dismissed 1 year, 2 months ago

WordPress Download Manager Plugin <= 3.2.59 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in W3 Eden, Inc. Download Manager plugin <= 3.2.59 versions.

References

https://patchstack.com/database/vulnerability/download-manager/wordpress-downlo… vdb-entry
https://patchstack.com/database/vulnerability/download-manager/wordpress-downlo… vdb-entryx_transferred
https://patchstack.com/database/vulnerability/download-manager/wordpress-downlo… vdb-entry
https://patchstack.com/database/vulnerability/download-manager/wordpress-downlo… vdb-entryx_transferred
https://patchstack.com/database/vulnerability/download-manager/wordpress-downlo… vdb-entry
https://patchstack.com/database/vulnerability/download-manager/wordpress-downlo… vdb-entryx_transferred

Affected products

download-manager

=<3.2.59

Matching in nixpkgs

pkgs.lomiri.lomiri-download-manager

Performs uploads and downloads from a centralized location

nixos-unstable 0.1.3
- nixpkgs-unstable 0.1.3
- nixos-unstable-small 0.1.3

Package maintainers

@OPNA2608 Cosima Neidahl <opna2608@protonmail.com>

Permalink CVE-2023-27456

4.3 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): LOW
Availability impact (A): NONE

updated 1 year, 4 months ago by @LeSuisse Activity log

Created automatic suggestion 1 year, 4 months ago
@LeSuisse dismissed 1 year, 4 months ago

WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin Activation

Missing Authorization vulnerability in HashThemes Total allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total: from n/a through 2.1.19.

References

https://patchstack.com/database/wordpress/theme/total/vulnerability/wordpress-t… vdb-entry

Affected products

total

=<2.1.19

Matching in nixpkgs

pkgs.autotalent

Real-time pitch correction LADSPA plugin (no MIDI control)

nixos-unstable 0.2
- nixpkgs-unstable 0.2
- nixos-unstable-small 0.2

pkgs.haskellPackages.total

Exhaustive pattern matching using lenses, traversals, and prisms

nixos-unstable 1.0.6
- nixpkgs-unstable 1.0.6
- nixos-unstable-small 1.0.6

pkgs.emacsPackages.total-lines

None

nixos-unstable 20171227.1239
- nixpkgs-unstable 20171227.1239
- nixos-unstable-small 20171227.1239

pkgs.haskellPackages.total-alternative

Alternative interface for total versions of partial function on the Prelude

nixos-unstable 0.1.0.1
- nixpkgs-unstable 0.1.0.1
- nixos-unstable-small 0.1.0.1

pkgs.python311Packages.total-connect-client

Interact with Total Connect 2 alarm systems

nixos-unstable 2024.12
- nixpkgs-unstable 2024.12
- nixos-unstable-small 2024.12

pkgs.python312Packages.total-connect-client

Interact with Total Connect 2 alarm systems

nixos-unstable 2024.12
- nixpkgs-unstable 2024.12
- nixos-unstable-small 2024.12

pkgs.home-assistant-component-tests.totalconnect

Open source home automation that puts local control and privacy first

nixos-unstable 2024.11.3
- nixpkgs-unstable 2024.11.3
- nixos-unstable-small 2024.11.3

Package maintainers

@michalrus Michal Rus <m@michalrus.com>
@Gabriella439 Gabriella Gonzalez <GenuineGabriella@gmail.com>
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@Mic92 Jörg Thalheim <joerg@thalheim.io>
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>

Dismissed suggestions

References

Affected products

Matching in nixpkgs

pkgs.libsForQt5.kdesignerplugin

pkgs.plasma5Packages.kdesignerplugin

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.cloud-init

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.haskellPackages.apportionment

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.juju

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.haskellPackages.apportionment

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.python311Packages.django-debug-toolbar

pkgs.python312Packages.django-debug-toolbar

pkgs.python311Packages.django-graphiql-debug-toolbar

pkgs.python312Packages.django-graphiql-debug-toolbar

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.wannier90

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.progress-tracker

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.lomiri.lomiri-download-manager

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.autotalent

pkgs.haskellPackages.total

pkgs.emacsPackages.total-lines

pkgs.haskellPackages.total-alternative

pkgs.python311Packages.total-connect-client

pkgs.python312Packages.total-connect-client

pkgs.home-assistant-component-tests.totalconnect

Package maintainers