Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-1069
published 5 months ago
Permalink CVE-2026-5479
updated 5 months ago by @LeSuisse Activity log
  • Created suggestion 5 months ago
  • @LeSuisse accepted 5 months ago
  • @LeSuisse published on GitHub 5 months ago

wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag

wolfSSL
  • <5.9.1
NIXPKGS-2026-1068
published 5 months ago
Permalink CVE-2026-40103
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months ago by @LeSuisse Activity log
  • Created suggestion 5 months ago
  • @LeSuisse ignored package vikunja-desktop 5 months ago
  • @LeSuisse accepted 5 months ago
  • @LeSuisse published on GitHub 5 months ago

Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds

vikunja
  • ==< 2.3.0
NIXPKGS-2026-1067
published 5 months ago
Permalink CVE-2026-35596
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 months ago by @LeSuisse Activity log
  • Created suggestion 5 months ago
  • @LeSuisse ignored package vikunja-desktop 5 months ago
  • @LeSuisse accepted 5 months ago
  • @LeSuisse published on GitHub 5 months ago

Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug

vikunja
  • ==< 2.3.0
NIXPKGS-2026-1066
published 5 months ago
Permalink CVE-2026-40189
updated 5 months ago by @LeSuisse Activity log
  • Created suggestion 5 months ago
  • @LeSuisse accepted 5 months ago
  • @LeSuisse published on GitHub 5 months ago

goshs has a file-based ACL authorization bypass in goshs state-changing routes

goshs
  • ==< 2.0.0-beta.4
NIXPKGS-2026-1065
published 5 months ago
Permalink CVE-2026-6069
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 5 months ago by @LeSuisse Activity log
  • Created suggestion 5 months ago
  • @LeSuisse ignored
    5 packages
    • nasmfmt
    • tree-sitter-grammars.tree-sitter-nasm
    • vimPlugins.nvim-treesitter-parsers.nasm
    • python313Packages.tree-sitter-grammars.tree-sitter-nasm
    • python314Packages.tree-sitter-grammars.tree-sitter-nasm
    5 months ago
  • @LeSuisse accepted 5 months ago
  • @LeSuisse published on GitHub 5 months ago

CVE-2026-6069

NASM
  • ==nasm-3.02rc5 
No patch available at the CVE publication
NIXPKGS-2026-1064
published 5 months ago
Permalink CVE-2026-40198
updated 5 months ago by @LeSuisse Activity log
  • Created suggestion 5 months ago
  • @LeSuisse accepted 5 months ago
  • @LeSuisse published on GitHub 5 months ago

Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass

Net-CIDR-Lite
  • <0.23
NIXPKGS-2026-1063
published 5 months ago
Permalink CVE-2026-5188
updated 5 months ago by @LeSuisse Activity log
  • Created suggestion 5 months ago
  • @LeSuisse accepted 5 months ago
  • @LeSuisse published on GitHub 5 months ago

Integer underflow in X.509 SAN parsing in wolfSSL

wolfSSL
  • =<5.9.0
NIXPKGS-2026-1062
published 5 months ago
Permalink CVE-2026-5500
updated 5 months ago by @LeSuisse Activity log
  • Created suggestion 5 months ago
  • @LeSuisse accepted 5 months ago
  • @LeSuisse published on GitHub 5 months ago

Improper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication Bypass

wolfSSL
  • =<5.9.0
NIXPKGS-2026-1061
published 5 months ago
Permalink CVE-2026-5501
updated 5 months ago by @LeSuisse Activity log
  • Created suggestion 5 months ago
  • @LeSuisse accepted 5 months ago
  • @LeSuisse published on GitHub 5 months ago

Improper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates

wolfSSL
  • =<5.9.0
NIXPKGS-2026-1060
published 5 months ago
Permalink CVE-2026-5466
updated 5 months ago by @LeSuisse Activity log
  • Created suggestion 5 months ago
  • @LeSuisse accepted 5 months ago
  • @LeSuisse published on GitHub 5 months ago

wc_VerifyEccsiHash missing sanity check

wolfSSL
  • <5.9.1