Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0518
published 6 months, 2 weeks ago
Permalink CVE-2026-27802
8.3 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): Low (L)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse ignored package vaultwarden-webvault 6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse deleted
    2 maintainers
    • @dotlambda
    • @SuperSandro2000
    6 months, 2 weeks ago maintainer.delete
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

vaultwarden
  • ==< 1.35.4 
Upstream advisory: https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-r32r-j5jq-3w4m
NIXPKGS-2026-0516
published 6 months, 2 weeks ago
Permalink CVE-2026-27803
8.3 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): Low (L)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse ignored package vaultwarden-webvault 6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse deleted
    2 maintainers
    • @dotlambda
    • @SuperSandro2000
    6 months, 2 weeks ago maintainer.delete
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

vaultwarden
  • ==< 1.35.4 
Upstream advisory: https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h4hq-rgvh-wh27
NIXPKGS-2026-0515
published 6 months, 2 weeks ago
Permalink CVE-2026-27801
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse ignored package vaultwarden-webvault 6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse deleted
    2 maintainers
    • @dotlambda
    • @SuperSandro2000
    6 months, 2 weeks ago maintainer.delete
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

vaultwarden
  • ==< 1.35.0 
Upstream advisory: https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-v6pg-v89r-w8wr
NIXPKGS-2026-0519
published 6 months, 2 weeks ago
Permalink CVE-2026-22040
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crash

nanomq
  • === 0.24.6 
Upstream advisory: https://github.com/nanomq/nanomq/security/advisories/GHSA-v57q-w88m-424r
NIXPKGS-2026-0509
published 6 months, 2 weeks ago
Permalink CVE-2026-27905
updated 6 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @mweinelt accepted 6 months, 2 weeks ago
  • @mweinelt published on GitHub 6 months, 2 weeks ago

BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction

BentoML
  • ==< 1.4.36 
https://github.com/bentoml/BentoML/commit/4e0eb007765ac04c7924220d643f264715cc9670
https://github.com/bentoml/BentoML/security/advisories/GHSA-m6w7-qv66-g3mf
NIXPKGS-2026-0513
published 6 months, 2 weeks ago
Permalink CVE-2026-27981
7.4 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

HomeBox has an Auth Rate Limit Bypass via IP Spoofing

homebox
  • ==< 0.24.0 
Upstream advisory: https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-j86g-v96v-jpp3
NIXPKGS-2026-0511
published 6 months, 2 weeks ago
Permalink CVE-2026-27932
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

joserfc
  • ==<= 1.6.2 
Upstream advisory: https://github.com/authlib/joserfc/security/advisories/GHSA-w5r5-m38g-f9f9
Upstream patch: https://github.com/authlib/joserfc/commit/696a9611ab982c45ee2190ed79ca8e1d8e09398f
NIXPKGS-2026-0512
published 6 months, 2 weeks ago
Permalink CVE-2026-27600
5.0 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

HomeBox affected by Blind SSRF

homebox
  • ==< 0.24.0-rc.1 
Upstream advisory: https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-cm7p-5mg5-82pm
NIXPKGS-2026-0514
published 6 months, 2 weeks ago
Permalink CVE-2026-26272
4.6 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

HomeBox affected by Stored XSS via HTML/SVG Attachment Upload

homebox
  • ==< 0.24.0-rc.1 
Upstream advisory: https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr
Upstream patch: https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892
NIXPKGS-2026-0510
published 6 months, 2 weeks ago
Permalink CVE-2026-27622
updated 6 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @LeSuisse ignored
    2 packages
    • haskellPackages.openexr-write
    • openexrid-unstable
    6 months, 2 weeks ago
  • @LeSuisse accepted 6 months, 2 weeks ago
  • @LeSuisse published on GitHub 6 months, 2 weeks ago

OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

openexr
  • ==>= 3.3.0, < 3.3.8
  • ==>= 2.3.0, < 3.2.6
  • ==>= 3.4.0, < 3.4.6 
Upstream advisory: https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-cr4v-6jm6-4963