Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0656
published 6 months ago
Permalink CVE-2026-30853
5.0 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse ignored package calibre-web 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

calibre has a Path Traversal Leading to Arbitrary File Write

calibre
  • ==< 9.5.0 
Upstream advisory: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-7mp7-rfrg-542x
NIXPKGS-2026-0650
published 6 months ago
Permalink CVE-2026-32597
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months, 1 week ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

pyjwt
  • ==< 2.12.0 
Upstream advisory: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f
NIXPKGS-2026-0635
published 6 months ago
Permalink CVE-2026-29775
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId

FreeRDP
  • ==< 3.24.0 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h666-rfw3-jhvj
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/ffad58fd2b329efd81a3239e9d7e3c927b8e503f
NIXPKGS-2026-0654
published 6 months ago
Permalink CVE-2026-30915
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

sftpgo
  • ==>= 2.3.0, < 2.7.1 
Upstream advisory: https://github.com/drakkan/sftpgo/security/advisories/GHSA-m83q-5wr4-4gfp
NIXPKGS-2026-0640
published 6 months ago
Permalink CVE-2026-31885
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks

FreeRDP
  • ==< 3.24.0 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h23r-3988-3wf3
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8
NIXPKGS-2026-0645
published 6 months ago
Permalink CVE-2026-30943
4.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

Gokapi has Privilege Escalation in File Replace

Gokapi
  • ==< 2.2.4 
Upstream advisory: https://github.com/Forceu/Gokapi/security/advisories/GHSA-j6jp-78w8-34x6
NIXPKGS-2026-0649
published 6 months ago
Permalink CVE-2026-3949
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Proof-of-Concept (P)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months, 1 week ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

strukturag libheif HEIF File decoder_vvdec.cc vvdec_push_data2 out-of-bounds

libheif
  • ==1.21.1
  • ==1.21.2
  • ==1.21.0 
Upstream issue: https://github.com/strukturag/libheif/issues/1712
Upstream patch: https://github.com/strukturag/libheif/commit/b97c8b5f198b27f375127cd597a35f2113544d03
NIXPKGS-2026-0658
published 6 months ago
Permalink CVE-2026-32136
9.8 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months, 1 week ago
  • @LeSuisse ignored
    3 packages
    • python312Packages.adguardhome
    • python313Packages.adguardhome
    • python314Packages.adguardhome
    6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass

AdGuardHome
  • ==< 0.107.73 
Upstream advisory: https://github.com/AdguardTeam/AdGuardHome/security/advisories/GHSA-5fg6-wrq4-w5gh
NIXPKGS-2026-0655
published 6 months ago
Permalink CVE-2026-32446
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability

wpforms-lite
  • =<<= 1.9.9.3
NIXPKGS-2026-0651
published 6 months ago
Permalink CVE-2026-32245
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months ago by @LeSuisse Activity log
  • Created suggestion 6 months, 1 week ago
  • @LeSuisse accepted 6 months ago
  • @LeSuisse published on GitHub 6 months ago

Tinyauth's OIDC authorization codes are not bound to client on token exchange

tinyauth
  • ==< 5.0.3 
Upstream advisory: https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-xg2q-62g2-cvcm
Upstream patch: https://github.com/steveiliop56/tinyauth/commit/b2a1bfb1f532e87f205fa3afa3fc9f148c53ab89