Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-1354
published 4 months, 2 weeks ago
Permalink CVE-2026-40684
5.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 4 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 2 weeks ago
  • @LeSuisse ignored
    4 maintainers
    • @4z3
    • @dasJ
    • @Conni2461
    • @helsinki-Jo
    4 months, 2 weeks ago maintainer.ignore
  • @LeSuisse accepted 4 months, 2 weeks ago
  • @LeSuisse published on GitHub 4 months, 2 weeks ago

In Exim before 4.99.2, on systems using musl libc (not …

Exim
  • <4.99.2
NIXPKGS-2026-1353
published 4 months, 2 weeks ago
Permalink CVE-2026-40685
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): High (H)
updated 4 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 2 weeks ago
  • @LeSuisse ignored
    4 maintainers
    • @4z3
    • @dasJ
    • @Conni2461
    • @helsinki-Jo
    4 months, 2 weeks ago maintainer.ignore
  • @LeSuisse accepted 4 months, 2 weeks ago
  • @LeSuisse published on GitHub 4 months, 2 weeks ago

In Exim before 4.99.2, when JSON lookup is enabled, an …

Exim
  • <4.99.2
NIXPKGS-2026-1352
published 4 months, 2 weeks ago
Permalink CVE-2026-40686
3.7 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 4 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 2 weeks ago
  • @LeSuisse ignored
    4 maintainers
    • @4z3
    • @Conni2461
    • @dasJ
    • @helsinki-Jo
    4 months, 2 weeks ago maintainer.ignore
  • @LeSuisse accepted 4 months, 2 weeks ago
  • @LeSuisse published on GitHub 4 months, 2 weeks ago

In Exim before 4.99.2, when utf8 operators are enabled, there …

Exim
  • <4.99.2
NIXPKGS-2026-1351
published 4 months, 2 weeks ago
Permalink CVE-2026-40687
4.8 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 4 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 2 weeks ago
  • @LeSuisse ignored
    4 maintainers
    • @4z3
    • @Conni2461
    • @dasJ
    • @helsinki-Jo
    4 months, 2 weeks ago maintainer.ignore
  • @LeSuisse accepted 4 months, 2 weeks ago
  • @LeSuisse published on GitHub 4 months, 2 weeks ago

In Exim before 4.99.2, when the SPA authentication driver is …

Exim
  • <4.99.2
NIXPKGS-2026-1350
published 4 months, 2 weeks ago
Permalink CVE-2026-28532
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Adjacent (A)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Adjacent (A)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 4 months, 2 weeks ago by @LeSuisse Activity log

FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions

frr
  • =<10.5.3
NIXPKGS-2026-1349
published 4 months, 2 weeks ago
Permalink CVE-2025-51846
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 4 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 2 weeks ago
  • @LeSuisse ignored
    2 references
    4 months, 2 weeks ago
  • @LeSuisse accepted 4 months, 2 weeks ago
  • @LeSuisse published on GitHub 4 months, 2 weeks ago

CryptPad unbounded WebSocket frame flood

Ignored references (2)
CryptPad
  • ==2026.2.2
  • <2026.2.2
NIXPKGS-2026-1348
published 4 months, 2 weeks ago
Permalink CVE-2026-39858
updated 4 months, 2 weeks ago by @LeSuisse Activity log

Traefik: Forwarded alias spoofing top pre-auth decision bypass

traefik
  • ==< 2.11.43
  • ==>= 3.0.0-beta1, < 3.6.14
  • ==>= 3.7.0-ea.1, < 3.7.0-rc.2
NIXPKGS-2026-1347
published 4 months, 2 weeks ago
Permalink CVE-2025-13030
7.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Proof-of-Concept (P)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 4 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 2 weeks ago
  • @LeSuisse accepted 4 months, 2 weeks ago
  • @LeSuisse published on GitHub 4 months, 2 weeks ago

All versions of the package django-mdeditor are vulnerable to Missing …

django-mdeditor
  • *
NIXPKGS-2026-1346
published 4 months, 2 weeks ago
Permalink CVE-2026-41174
updated 4 months, 2 weeks ago by @LeSuisse Activity log

Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

traefik
  • ==< 2.11.43
  • ==>= 3.7.0-ea.1, < 3.7.0-rc.2 
No real impact in standard NixOS use case.
NIXPKGS-2026-1345
published 4 months, 2 weeks ago
Permalink CVE-2026-41263
updated 4 months, 2 weeks ago by @LeSuisse Activity log

Traefik: BasicAuth middleware: timing side-channel vulnerability

traefik
  • ==< 2.11.43
  • ==>= 3.0.0-beta1, < 3.6.14
  • ==>= 3.7.0-ea.1, < 3.7.0-rc.2