Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0643
published 6 months ago
Permalink CVE-2026-30961
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload

Gokapi
  • ==< 2.2.4 
Upstream advisory: https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp
NIXPKGS-2026-0653
published 6 months ago
Permalink CVE-2026-30914
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy

sftpgo
  • ==< 2.7.1 
Upstream advisory: https://github.com/drakkan/sftpgo/security/advisories/GHSA-x8qh-7475-c5mp
NIXPKGS-2026-0638
published 6 months ago
Permalink CVE-2026-31806
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions

FreeRDP
  • ==< 3.24.0 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrqm-46rj-cmx2
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/83d9aedea278a74af3e490ff5eeb889c016dbb2b
NIXPKGS-2026-0633
published 6 months ago
Permalink CVE-2026-29078
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

Integer Underflow in Lexbor ISO‑2022‑JP Encoder

lexbor
  • ==< 2.7.0 
Upstream advisory: https://github.com/lexbor/lexbor/security/advisories/GHSA-mrwr-xh7f-96v3
NIXPKGS-2026-0644
published 6 months ago
Permalink CVE-2026-31949
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convos

LibreChat
  • ==< 0.8.3-rc1 
Upstream advisory: https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5m32-chq6-232p
NIXPKGS-2026-0639
published 6 months ago
Permalink CVE-2026-29774
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

FreeRDP has a heap-buffer-overflow in avc420_yuv_to_rgb via OOB regionRects

FreeRDP
  • ==< 3.24.0 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5q35-hv9x-7794
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/6482b7a92fff3959582cef052d1967ad6bde3738
NIXPKGS-2026-0634
published 6 months ago
Permalink CVE-2026-31897
0.0 NONE
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

FreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`

FreeRDP
  • ==< 3.24.0 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xgv6-r22m-7c9x
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/cd27c8faca0eeb0d4309cc5837dfdf3c42eba4e7
NIXPKGS-2026-0636
published 6 months ago
Permalink CVE-2026-31883
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write

FreeRDP
  • ==< 3.24.0 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8
NIXPKGS-2026-0641
published 6 months ago
Permalink CVE-2026-29776
3.1 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library

FreeRDP
  • ==< 3.24.0 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c747-x4wf-cqrr
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/a9e0abf2eac8c2e370fa155bf1abb9d044c0ca8a
NIXPKGS-2026-0646
published 6 months ago
Permalink CVE-2026-31899
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification

CairoSVG
  • ==< 2.9.0 
Upstream advisory: https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c
Upstream patch: https://github.com/Kozea/CairoSVG/commit/6dde8685ed3f19837767bce7a13a5491e3d0e0bf