Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0876
published 5 months, 2 weeks ago
Permalink CVE-2025-66215
3.8 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Physical (P)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Physical (P)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 5 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @mweinelt ignored
    11 packages
    • openscad
    • openscap
    • openscreen
    • openscad-lsp
    • openscenegraph
    • openscad-unstable
    • kakounePlugins.openscad-kak
    • vscode-extensions.antyos.openscad
    • tree-sitter-grammars.tree-sitter-openscad
    • python313Packages.tree-sitter-grammars.tree-sitter-openscad
    • python314Packages.tree-sitter-grammars.tree-sitter-openscad
    5 months, 2 weeks ago
  • @mweinelt accepted 5 months, 2 weeks ago
  • @mweinelt published on GitHub 5 months, 2 weeks ago

OpenSC: Stack-buffer-overflow WRITE in card-oberthur

OpenSC
  • ==< 0.27.0 
https://github.com/OpenSC/OpenSC/security/advisories/GHSA-q5fc-cw56-hwp2
NIXPKGS-2026-0874
published 5 months, 2 weeks ago
Permalink CVE-2026-33729
updated 5 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @mweinelt ignored
    4 packages
    • python314Packages.openfga-sdk
    • python313Packages.openfga-sdk
    • python312Packages.openfga-sdk
    • openfga-cli
    5 months, 2 weeks ago
  • @mweinelt accepted 5 months, 2 weeks ago
  • @mweinelt published on GitHub 5 months, 2 weeks ago

OpenFGA has an Authorization Bypass through cached keys

openfga
  • ==< 1.13.1 
https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf
NIXPKGS-2026-0872
published 5 months, 2 weeks ago
Permalink CVE-2025-66037
3.9 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Physical (P)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Physical (P)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 5 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @mweinelt ignored
    11 packages
    • openscad
    • openscap
    • openscreen
    • openscad-lsp
    • openscenegraph
    • openscad-unstable
    • kakounePlugins.openscad-kak
    • vscode-extensions.antyos.openscad
    • tree-sitter-grammars.tree-sitter-openscad
    • python313Packages.tree-sitter-grammars.tree-sitter-openscad
    • python314Packages.tree-sitter-grammars.tree-sitter-openscad
    5 months, 2 weeks ago
  • @mweinelt accepted 5 months, 2 weeks ago
  • @mweinelt published on GitHub 5 months, 2 weeks ago

OpenSC: Out of Bounds vulnerability

OpenSC
  • ==< 0.27.0 
https://github.com/OpenSC/OpenSC/security/advisories/GHSA-m58q-rmjm-mmfx
NIXPKGS-2026-0870
published 5 months, 2 weeks ago
Permalink CVE-2026-5123
3.7 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Not Defined (X)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 5 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @mweinelt accepted 5 months, 2 weeks ago
  • @mweinelt published on GitHub 5 months, 2 weeks ago

osrg GoBGP bgp.go DecodeFromBytes off-by-one

GoBGP
  • ==4.0
  • ==4.1
  • ==4.3.0
  • ==4.2 
https://github.com/osrg/gobgp/commit/67c059413470df64bc20801c46f64058e88f800f
https://github.com/osrg/gobgp/pull/3342
NIXPKGS-2026-0868
published 5 months, 2 weeks ago
Permalink CVE-2026-2287
updated 5 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @mweinelt ignored
    5 packages
    • pkgsRocm.crewai
    • python312Packages.crewai
    • python313Packages.crewai
    • python314Packages.crewai
    • pkgsRocm.python3Packages.crewai
    5 months, 2 weeks ago
  • @mweinelt accepted 5 months, 2 weeks ago
  • @mweinelt published on GitHub 5 months, 2 weeks ago

CVE-2026-2287

CrewAI
  • ==1.0 
https://www.kb.cert.org/vuls/id/221883
NIXPKGS-2026-0866
published 5 months, 2 weeks ago
Permalink CVE-2026-2285
updated 5 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @mweinelt ignored
    5 packages
    • pkgsRocm.crewai
    • python312Packages.crewai
    • python313Packages.crewai
    • python314Packages.crewai
    • pkgsRocm.python3Packages.crewai
    5 months, 2 weeks ago
  • @mweinelt accepted 5 months, 2 weeks ago
  • @mweinelt published on GitHub 5 months, 2 weeks ago

CVE-2026-2285

CrewAI
  • ==1.0 
https://www.kb.cert.org/vuls/id/221883
NIXPKGS-2026-0864
published 5 months, 2 weeks ago
Permalink CVE-2026-3945
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 5 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @mweinelt accepted 5 months, 2 weeks ago
  • @mweinelt published on GitHub 5 months, 2 weeks ago

An integer overflow vulnerability in the HTTP chunked transfer encoding …

tinyproxy
  • ==<=1.11.3 
https://github.com/tinyproxy/tinyproxy/pull/603
NIXPKGS-2026-0862
published 5 months, 2 weeks ago
Permalink CVE-2026-33987
7.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @mweinelt accepted 5 months, 2 weeks ago
  • @mweinelt published on GitHub 5 months, 2 weeks ago

FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write

FreeRDP
  • ==< 3.24.2 
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ff8h-p5vc-wcwc
NIXPKGS-2026-0860
published 5 months, 2 weeks ago
Permalink CVE-2026-5122
3.7 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Exploit Code Maturity (E): Not Defined (X)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @mweinelt accepted 5 months, 2 weeks ago
  • @mweinelt published on GitHub 5 months, 2 weeks ago

osrg GoBGP BGP OPEN Message bgp.go DecodeFromBytes access control

GoBGP
  • ==4.0
  • ==4.1
  • ==4.3.0
  • ==4.2 
https://github.com/osrg/gobgp/pull/3343
https://github.com/osrg/gobgp/commit/2b09db390a3d455808363c53e409afe6b1b86d2d
NIXPKGS-2026-0858
published 5 months, 2 weeks ago
Permalink CVE-2025-66038
3.9 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Physical (P)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Physical (P)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 5 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 5 months, 2 weeks ago
  • @mweinelt ignored
    11 packages
    • openscad
    • openscap
    • openscreen
    • openscad-lsp
    • openscenegraph
    • openscad-unstable
    • kakounePlugins.openscad-kak
    • vscode-extensions.antyos.openscad
    • tree-sitter-grammars.tree-sitter-openscad
    • python313Packages.tree-sitter-grammars.tree-sitter-openscad
    • python314Packages.tree-sitter-grammars.tree-sitter-openscad
    5 months, 2 weeks ago
  • @mweinelt accepted 5 months, 2 weeks ago
  • @mweinelt published on GitHub 5 months, 2 weeks ago

OpenSC: `sc_compacttlv_find_tag` can return out-of-bounds pointers

OpenSC
  • ==< 0.27.0 
https://github.com/OpenSC/OpenSC/security/advisories/GHSA-72x5-fwjx-2459