Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0427
published 6 months, 4 weeks ago
Permalink CVE-2026-27150
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Discourse doesn't ensure guardian check when creating QueryGroupBookmark

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-rw95-54qr-qrw8
NIXPKGS-2026-0426
published 6 months, 4 weeks ago
Permalink CVE-2026-27151
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Discourse doesn't validate destination topic when moving posts

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-m69h-9m2g-cfgw
NIXPKGS-2026-0425
published 6 months, 4 weeks ago
Permalink CVE-2026-28215
9.1 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover

hoppscotch
  • ==< 2026.2.0 
Upstream advisory: https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-jwv8-867r-q9fg
NIXPKGS-2026-0424
published 6 months, 4 weeks ago
Permalink CVE-2026-28296
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths

gvfs
Upstream issue: https://gitlab.gnome.org/GNOME/gvfs/-/issues/833
Upstream patch: https://gitlab.gnome.org/GNOME/gvfs/-/commit/21dda19047b86c3e92fae668eb9dc80e33ca71fd
NIXPKGS-2026-0423
published 6 months, 4 weeks ago
Permalink CVE-2026-27969
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Vitess users with backup storage access can write to arbitrary file paths on restore

vitess
  • ==>= 23.0.0, < 23.0.3
  • ==< 22.0.4 
Upstream advisory: https://github.com/vitessio/vitess/security/advisories/GHSA-r492-hjgh-c9gw
Upstream patch: https://github.com/vitessio/vitess/commit/c565cab615bc962bda061dcd645aa7506c59ca4a
NIXPKGS-2026-0422
published 6 months, 4 weeks ago
Permalink CVE-2026-27638
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored package gnomeExtensions.maximized-by-default-actually-reborn 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode

actual
  • ==< 26.2.1 
Upstream advisory: https://github.com/actualbudget/actual/security/advisories/GHSA-qmjj-p7m9-wjrv
Upstream patch: https://github.com/actualbudget/actual/commit/9966c024cb75f57943193cac8e42f401efed9d08
NIXPKGS-2026-0421
published 6 months, 4 weeks ago
Permalink CVE-2026-27584
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored package gnomeExtensions.maximized-by-default-actually-reborn 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints

actual
  • ==< 26.2.1 
Upstream advisory: https://github.com/actualbudget/actual/security/advisories/GHSA-m2cq-xjgm-f668
Upstream patch: https://github.com/actualbudget/actual/commit/ea937d100956ca56689ff852d99c28589e2a7d88
NIXPKGS-2026-0420
published 6 months, 4 weeks ago
Permalink CVE-2026-28217
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections

hoppscotch
  • ==< 2026.2.0 
Upstream advisory: https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-m5pg-r4jp-qq75
NIXPKGS-2026-0419
published 6 months, 4 weeks ago
Permalink CVE-2026-28216
8.3 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): Low (L)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment

hoppscotch
  • ==< 2026.2.0 
Upstream advisory: https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-72rv-vc3j-5vqr
NIXPKGS-2026-0418
published 6 months, 4 weeks ago
Permalink CVE-2026-27945
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored package zitadel-tools 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

ZITADEL has potential SSRF via Actions

zitadel
  • ==>= 2.59.0, < 4.11.1 
Upstream advisory: https://github.com/zitadel/zitadel/security/advisories/GHSA-7777-fhq9-592v