Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0949
published 5 months, 1 week ago
Permalink CVE-2026-35387
3.1 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored
    8 packages
    • openssh-askpass
    • opensshWithKerberos
    • perlPackages.NetOpenSSH
    • perl5Packages.NetOpenSSH
    • lxqt.lxqt-openssh-askpass
    • perl538Packages.NetOpenSSH
    • perl540Packages.NetOpenSSH
    • openssh_gssapi
    5 months, 1 week ago
  • @LeSuisse accepted 5 months, 1 week ago
  • @LeSuisse published on GitHub 5 months, 1 week ago

OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of …

OpenSSH
  • <10.3
NIXPKGS-2026-0948
published 5 months, 1 week ago
Permalink CVE-2026-35414
4.2 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored
    7 packages
    • opensshTest
    • openssh-askpass
    • perlPackages.NetOpenSSH
    • perl5Packages.NetOpenSSH
    • lxqt.lxqt-openssh-askpass
    • perl538Packages.NetOpenSSH
    • perl540Packages.NetOpenSSH
    5 months, 1 week ago
  • @LeSuisse accepted 5 months, 1 week ago
  • @LeSuisse published on GitHub 5 months, 1 week ago

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon …

OpenSSH
  • <10.3
NIXPKGS-2026-0947
published 5 months, 1 week ago
Permalink CVE-2026-35388
2.5 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored
    7 packages
    • opensshTest
    • openssh-askpass
    • perlPackages.NetOpenSSH
    • perl5Packages.NetOpenSSH
    • lxqt.lxqt-openssh-askpass
    • perl538Packages.NetOpenSSH
    • perl540Packages.NetOpenSSH
    5 months, 1 week ago
  • @LeSuisse accepted 5 months, 1 week ago
  • @LeSuisse published on GitHub 5 months, 1 week ago

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing …

OpenSSH
  • <10.3
NIXPKGS-2026-0946
published 5 months, 1 week ago
Permalink CVE-2026-35386
3.6 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored
    7 packages
    • opensshTest
    • openssh-askpass
    • perlPackages.NetOpenSSH
    • perl5Packages.NetOpenSSH
    • lxqt.lxqt-openssh-askpass
    • perl538Packages.NetOpenSSH
    • perl540Packages.NetOpenSSH
    5 months, 1 week ago
  • @LeSuisse accepted 5 months, 1 week ago
  • @LeSuisse published on GitHub 5 months, 1 week ago

In OpenSSH before 10.3, command execution can occur via shell …

OpenSSH
  • <10.3
NIXPKGS-2026-0945
published 5 months, 2 weeks ago
Permalink CVE-2026-34528
8.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored
    4 packages
    • filebrowser-quantum
    • python312Packages.filebrowser-safe
    • python313Packages.filebrowser-safe
    • python314Packages.filebrowser-safe
    5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution

filebrowser
  • ==< 2.62.2 
Advisory: https://github.com/filebrowser/filebrowser/security/advisories/GHSA-x8jc-jvqm-pm3f
NIXPKGS-2026-0944
published 5 months, 2 weeks ago
Permalink CVE-2026-5199
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored
    21 packages
    • temporalite
    • temporal-cli
    • temporal_capi
    • temporal-ui-server
    • python312Packages.temporalio
    • python313Packages.temporalio
    • python314Packages.temporalio
    • haskellPackages.temporal-media
    • terraform-providers.temporalcloud
    • postgresqlPackages.temporal_tables
    • haskellPackages.temporal-api-protos
    • postgresql13Packages.temporal_tables
    • postgresql14Packages.temporal_tables
    • postgresql15Packages.temporal_tables
    • postgresql16Packages.temporal_tables
    • postgresql17Packages.temporal_tables
    • postgresql18Packages.temporal_tables
    • haskellPackages.temporal-music-notation
    • haskellPackages.temporal-music-notation-demo
    • terraform-providers.temporalio_temporalcloud
    • haskellPackages.temporal-music-notation-western
    5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

Cross Namespace Access via Batch Operation

temporal
  • <1.30.3
  • <1.29.5 
https://github.com/temporalio/temporal/releases/tag/v1.29.5
https://github.com/temporalio/temporal/releases/tag/v1.30.3
NIXPKGS-2026-0943
published 5 months, 2 weeks ago
Permalink CVE-2026-35092
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored package corosync-qdevice 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

Corosync: corosync: denial of service via integer overflow in join message validation

rhcos
corosync
No upstream fix (2026-04-02)

RH tracking issue: https://bugzilla.redhat.com/show_bug.cgi?id=2453169
NIXPKGS-2026-0942
published 5 months, 2 weeks ago
Permalink CVE-2026-35091
8.2 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored package corosync-qdevice 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

Corosync: corosync: denial of service and information disclosure via crafted udp packet

rhcos
corosync
No upstream fix (2026-04-02)

RH tracking issue: https://bugzilla.redhat.com/show_bug.cgi?id=2453169
NIXPKGS-2026-0941
published 5 months, 2 weeks ago
Permalink CVE-2026-34376
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

PdfDing: Password-protected share bypass via direct serve endpoint

PdfDing
  • ==< 1.7.0 
Advisory: https://github.com/mrmn2/PdfDing/security/advisories/GHSA-42x7-vvj4-4cj3
Patch: https://github.com/mrmn2/PdfDing/commit/ae579ea98c5603d1435e0d90e81d72151564088a
NIXPKGS-2026-0940
published 5 months, 2 weeks ago
Permalink CVE-2026-34530
6.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored
    4 packages
    • filebrowser-quantum
    • python312Packages.filebrowser-safe
    • python313Packages.filebrowser-safe
    • python314Packages.filebrowser-safe
    5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection

filebrowser
  • ==< 2.62.2 
Advisory: https://github.com/filebrowser/filebrowser/security/advisories/GHSA-xfqj-3vmx-63wv