Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-1163
published 4 months, 4 weeks ago
Permalink CVE-2026-34232
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 4 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 4 weeks ago
  • @LeSuisse ignored package firebird-emu 4 months, 4 weeks ago
  • @LeSuisse accepted 4 months, 4 weeks ago
  • @LeSuisse published on GitHub 4 months, 4 weeks ago

Firebird: DoS via `op_response` packet from client

firebird
  • ==>= 4.0.0, < 4.0.7
  • ==>= 5.0.0, < 5.0.4
  • ==>= 3.0.0, < 3.0.14
NIXPKGS-2026-1165
published 4 months, 4 weeks ago
Permalink CVE-2026-28214
updated 4 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 4 weeks ago
  • @LeSuisse ignored package firebird-emu 4 months, 4 weeks ago
  • @LeSuisse accepted 4 months, 4 weeks ago
  • @LeSuisse published on GitHub 4 months, 4 weeks ago

Firebird server hangs when using specific clumplet on batch creation

firebird
  • ==>= 4.0.0, < 4.0.7
  • ==>= 5.0.0, < 5.0.4
  • ==>= 3.0.0, < 3.0.14
NIXPKGS-2026-1161
published 4 months, 4 weeks ago
Permalink CVE-2026-40335
5.2 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Physical (P)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Physical (P)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 4 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 4 weeks ago
  • @LeSuisse accepted 4 months, 4 weeks ago
  • @LeSuisse published on GitHub 4 months, 4 weeks ago

libgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.c

libgphoto2
  • ==<= 2.5.33
NIXPKGS-2026-1162
published 4 months, 4 weeks ago
Permalink CVE-2026-40342
9.9 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 4 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 4 weeks ago
  • @LeSuisse ignored package firebird-emu 4 months, 4 weeks ago
  • @LeSuisse accepted 4 months, 4 weeks ago
  • @LeSuisse published on GitHub 4 months, 4 weeks ago

Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution

firebird
  • ==>= 4.0.0, < 4.0.7
  • ==>= 5.0.0, < 5.0.4
  • ==< 3.0.14
NIXPKGS-2026-1160
published 4 months, 4 weeks ago
Permalink CVE-2026-35215
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 4 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 4 weeks ago
  • @LeSuisse ignored package firebird-emu 4 months, 4 weeks ago
  • @LeSuisse accepted 4 months, 4 weeks ago
  • @LeSuisse published on GitHub 4 months, 4 weeks ago

Firebird: DoS via malicious slice descriptor in slice packet

firebird
  • ==>= 4.0.0, < 4.0.7
  • ==>= 5.0.0, < 5.0.4
  • ==>= 3.0.0, < 3.0.14
NIXPKGS-2026-1159
published 4 months, 4 weeks ago
Permalink CVE-2026-27890
8.2 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): High (H)
updated 4 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 4 weeks ago
  • @LeSuisse ignored package firebird-emu 4 months, 4 weeks ago
  • @LeSuisse accepted 4 months, 4 weeks ago
  • @LeSuisse published on GitHub 4 months, 4 weeks ago

Firebird has Pre-Auth DOS when Processing Out of Order CNCT_specific_data Segments

firebird
  • ==>= 4.0.0, < 4.0.7
  • ==>= 5.0.0, < 5.0.4
  • ==>= 3.0.0, < 3.0.14
NIXPKGS-2026-1158
published 4 months, 4 weeks ago
Permalink CVE-2026-40479
5.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 4 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 4 weeks ago
  • @LeSuisse accepted 4 months, 4 weeks ago
  • @LeSuisse published on GitHub 4 months, 4 weeks ago

Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget

kimai
  • ==>= 1.16.3, < 2.53.0
NIXPKGS-2026-1157
published 4 months, 4 weeks ago
Permalink CVE-2026-33145
6.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 4 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 4 weeks ago
  • @LeSuisse ignored package pulseaudio-module-xrdp 4 months, 4 weeks ago
  • @LeSuisse accepted 4 months, 4 weeks ago
  • @LeSuisse published on GitHub 4 months, 4 weeks ago

xrdp: Authenticated RCE via unsanitized AlternateShell execution in xrdp-sesman

xrdp
  • ==< 0.10.6
NIXPKGS-2026-1156
published 4 months, 4 weeks ago
Permalink CVE-2026-23500
updated 4 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 4 weeks ago
  • @LeSuisse accepted 4 months, 4 weeks ago
  • @LeSuisse published on GitHub 4 months, 4 weeks ago

Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration

dolibarr
  • ==< 23.0.0
NIXPKGS-2026-1155
published 4 months, 4 weeks ago
Permalink CVE-2026-40303
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 4 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 4 weeks ago
  • @LeSuisse ignored maintainer @bennyandresen 4 months, 4 weeks ago maintainer.ignore
  • @LeSuisse accepted 4 months, 4 weeks ago
  • @LeSuisse published on GitHub 4 months, 4 weeks ago

zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing

zrok
  • ==< 2.0.1