Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0703
published 5 months, 3 weeks ago
Permalink CVE-2026-33476
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 4 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal

siyuan
  • ==< 3.6.2 
Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7
Upstream patch: https://github.com/siyuan-note/siyuan/commit/009bb598b3beccc972aa5f1ed88b3b224326bf2a
NIXPKGS-2026-0699
published 5 months, 3 weeks ago
Permalink CVE-2026-32749
7.6 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 4 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

siyuan
  • ==< 3.6.1 
Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvvf-q994-x79v
Upstream patch: https://github.com/siyuan-note/siyuan/commit/5ee00907f0b0c4aca748ce21ef1977bb98178e14
NIXPKGS-2026-0695
published 5 months, 3 weeks ago
Permalink CVE-2026-32815
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 4 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure

siyuan
  • ==< 3.6.1 
Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xp2m-98x8-rpj6
Upstream patch: https://github.com/siyuan-note/siyuan/commit/1e370e37359778c0932673e825182ff555b504a3
NIXPKGS-2026-0691
published 5 months, 3 weeks ago
Permalink CVE-2026-4115
3.7 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Exploit Code Maturity (E): Proof-of-Concept (P)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification

PuTTY
  • ==0.83 
Upstream patch: https://git.tartarus.org/?p=simon%2Fputty.git%3Ba%3Dcommitdiff%3Bh%3Daf996b5ec27ab79bae3882071b9d6acf16044549
Exploit: https://github.com/py-thok/putty-ed25519-malleability-s-plus-l
NIXPKGS-2026-0687
published 5 months, 3 weeks ago
Permalink CVE-2026-33130
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 4 weeks ago
  • @LeSuisse ignored
    7 packages
    • python312Packages.uptime-kuma-api
    • python313Packages.uptime-kuma-api
    • python314Packages.uptime-kuma-api
    • gnomeExtensions.uptime-kuma-indicator
    • python312Packages.uptime-kuma-monitor
    • python313Packages.uptime-kuma-monitor
    • python314Packages.uptime-kuma-monitor
    5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)

uptime-kuma
  • ==>= 1.23.0, < 2.2.1 
Upstream advisory: https://github.com/louislam/uptime-kuma/security/advisories/GHSA-v832-4r73-wx5j
NIXPKGS-2026-0683
published 5 months, 3 weeks ago
Permalink CVE-2026-33067
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 4 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

siyuan
  • ==< 3.6.1 
Upstream advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mvpm-v6q4-m2pf
NIXPKGS-2026-0713
published 5 months, 3 weeks ago
Permalink CVE-2026-33411
5.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 4 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

Discourse's solved topic stream has potential stored XSS in topic title

discourse
  • ==>= 2026.2.0-latest, < 2026.2.1
  • === 2026.3.0-latest
  • ==>= 2026.1.0-latest, < 2026.1.2 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-j3mm-ghh2-83x2
NIXPKGS-2026-0688
published 5 months, 3 weeks ago
Permalink CVE-2026-33236
8.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 4 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

nltk
  • ==<= 3.9.3 
Upstream advisory: https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7
Upstream patch: https://github.com/nltk/nltk/commit/89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a
NIXPKGS-2026-0692
published 5 months, 3 weeks ago
Permalink CVE-2026-33550
2.0 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 3 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

SOGo before 5.12.5 does not renew the OTP if a …

SOGo
  • <5.12.5 
Upstream patch: https://github.com/Alinto/sogo/commit/83d4c522f87cfde0ba543837d9b24c3479083ec2
NIXPKGS-2026-0696
published 5 months, 3 weeks ago
Permalink CVE-2026-4395
updated 5 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 5 months, 4 weeks ago
  • @LeSuisse accepted 5 months, 3 weeks ago
  • @LeSuisse published on GitHub 5 months, 3 weeks ago

Heap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path

wolfssl
  • =<5.8.4 
Upstream patch: https://github.com/wolfSSL/wolfssl/commit/ddc177b669cff9d3c7e1b51751f9df73062b872a