Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0921
published 5 months, 2 weeks ago
Permalink CVE-2026-34155
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

RAUC: Improper Signing of Plain Bundles Exceeding 2 GiB

rauc
  • ==< 1.15.2 
Upstream advisory: https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hx
Patch: https://github.com/rauc/rauc/commit/4fb7c798d6ae412344fb8f8d310d773046af3441
NIXPKGS-2026-0920
published 5 months, 2 weeks ago
Permalink CVE-2026-34036
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php

dolibarr
  • ==<= 22.0.4 
Advisory: https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-2mfj-r695-5h9r
Patch: https://github.com/Dolibarr/dolibarr/commit/743c22e57c0b2a017d6b92bec865d71ce6177a6a
NIXPKGS-2026-0919
published 5 months, 2 weeks ago
Permalink CVE-2026-5236
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Proof-of-Concept (P)
  • Remediation Level (RL): Not Defined (X)
  • Report Confidence (RC): Reasonable (R)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow

Bento4
  • ==1.6.0-641 
Upstream issue: https://github.com/axiomatic-systems/Bento4/issues/1059
Currently (2026-04-01) no patch available
NIXPKGS-2026-0918
published 5 months, 2 weeks ago
Permalink CVE-2026-34586
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

PdfDing: Shared PDF Expiration, Max Views, and Deletion Bypass via Serve/Download Endpoints

PdfDing
  • ==< 1.7.1 
Upstream advisory: https://github.com/mrmn2/PdfDing/security/advisories/GHSA-vfqx-2464-38wf
Patch: https://github.com/mrmn2/PdfDing/commit/a6783b259b25c839c52c6f2380333827a52e89eb
NIXPKGS-2026-0917
published 5 months, 2 weeks ago
Permalink CVE-2026-32725
8.3 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): Low (L)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

SciTokens C++: Relative Path Traversal Vulnerability

scitokens-cpp
  • ==< 1.4.1 
Advisory: https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-rqcx-mc9w-pjxp
Patch: https://github.com/scitokens/scitokens-cpp/commit/7951ed809967d88c00c20de414b1ff74df8c3e08
NIXPKGS-2026-0916
published 5 months, 2 weeks ago
Permalink CVE-2026-3308
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored
    11 packages
    • python312Packages.pymupdf
    • python313Packages.pymupdf
    • python314Packages.pymupdf
    • python312Packages.pymupdf4llm
    • mupdf-headless
    • python313Packages.pymupdf4llm
    • python314Packages.pymupdf4llm
    • zathuraPkgs.zathura_pdf_mupdf
    • python312Packages.pymupdf-fonts
    • python313Packages.pymupdf-fonts
    • python314Packages.pymupdf-fonts
    5 months, 2 weeks ago
  • @LeSuisse restored package mupdf-headless 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

CVE-2026-3308

MuPDF
  • =<1.27.0 
Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=a26f0142e7d390d4a82c6e5ae0e312e07cc4ec85
NIXPKGS-2026-0915
published 5 months, 2 weeks ago
Permalink CVE-2026-5190
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

AWS C Event Stream Streaming Decoder Stack Buffer Overflow

aws-c-event-stream
  • ==0.6.0 
Advisory: https://github.com/awslabs/aws-c-event-stream/security/advisories/GHSA-xvjw-fjq5-68hf
NIXPKGS-2026-0914
published 5 months, 2 weeks ago
Permalink CVE-2026-34060
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse ignored package vscode-extensions.shopify.ruby-lsp 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

Ruby LSP has arbitrary code execution through branch setting

ruby-lsp
  • ==< 0.26.9
Shopify.ruby-lsp
  • ==< 0.10.2 
Advisory: https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93
NIXPKGS-2026-0913
published 5 months, 2 weeks ago
Permalink CVE-2026-32727
8.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

SciTokens: Authorization Bypass via Path Traversal in Scope Validation

scitokens
  • ==< 1.9.7 
Advisory: https://github.com/scitokens/scitokens/security/advisories/GHSA-3x2w-63fp-3qvw
Patch: https://github.com/scitokens/scitokens/commit/2d1cc9e42bc944fe0bbc429b85d166e7156d53f9
NIXPKGS-2026-0912
published 5 months, 2 weeks ago
Permalink CVE-2026-5235
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Proof-of-Concept (P)
  • Remediation Level (RL): Not Defined (X)
  • Report Confidence (RC): Reasonable (R)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 5 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @LeSuisse accepted 5 months, 2 weeks ago
  • @LeSuisse published on GitHub 5 months, 2 weeks ago

Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow

Bento4
  • ==1.6.0-641 
Unpatched
Upstream issue: https://github.com/axiomatic-systems/Bento4/issues/1058