Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0007
published 7 months ago
Permalink CVE-2025-13742
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 8 months, 1 week ago
  • @LeSuisse ignored package pretix-banktool 7 months ago
  • @mweinelt accepted 7 months ago
  • @LeSuisse deleted maintainer @mweinelt 7 months ago maintainer.delete
  • @LeSuisse published on GitHub 7 months ago

Limited HTML injection in emails

pretix
  • <2025.7.0
  • <2025.8.0
  • <2025.9.0
  • <2025.10.0 
fbad460b426553178200c2c13d3c3ffef3db61dd (unstable)
d367441a2a542b46bcd8966f654045b7054f5d39 (25.11)
95c90c7122daae516db39fffda5bb4e13dd9161e (25.05)
NIXPKGS-2026-0001
published 7 months ago
Permalink CVE-2025-34449
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored package qtscrcpy 7 months ago
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

Genymobile/scrcpy <= 3.3.3 Global Buffer Overflow

scrcpy
  • ==commit 3e40b24
  • =<3.3.3 
Patch: https://github.com/Genymobile/scrcpy/commit/3e40b2473772cea3a23d4932088fd0bc4cc0f52c

Fixed in 3.3.4 https://github.com/Genymobile/scrcpy/releases/tag/v3.3.4
NIXPKGS-2025-0023
published 7 months, 2 weeks ago
Permalink CVE-2025-11683
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Adjacent (A)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Adjacent (A)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 7 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 8 months, 3 weeks ago
  • @LeSuisse accepted 7 months, 2 weeks ago
  • @LeSuisse published on GitHub 7 months, 2 weeks ago

YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure

YAML-Syck
  • <1.36
NIXPKGS-2025-0018
published 7 months, 3 weeks ago
Permalink CVE-2025-61662
4.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 7 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 8 months, 3 weeks ago
  • @LeSuisse deleted
    4 maintainers
    • @SigmaSquadron
    • @hehongbo
    • @digitalrane
    • @CertainLach
    7 months, 3 weeks ago maintainer.delete
  • @LeSuisse ignored
    2 packages
    • grub2_pvhgrub_image
    • grub2_pvgrub_image
    7 months, 3 weeks ago
  • @LeSuisse accepted 7 months, 3 weeks ago
  • @LeSuisse published on GitHub 7 months, 3 weeks ago

Grub2: missing unregister call for gettext command may lead to use-after-free

grub2
  • =<2.14
rhcos
NIXPKGS-2025-0017
published 7 months, 3 weeks ago
Permalink CVE-2025-61663
4.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 7 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 8 months, 3 weeks ago
  • @LeSuisse deleted
    4 maintainers
    • @SigmaSquadron
    • @hehongbo
    • @digitalrane
    • @CertainLach
    7 months, 3 weeks ago maintainer.delete
  • @LeSuisse ignored
    2 packages
    • grub2_pvgrub_image
    • grub2_pvhgrub_image
    7 months, 3 weeks ago
  • @LeSuisse accepted 7 months, 3 weeks ago
  • @LeSuisse published on GitHub 7 months, 3 weeks ago

Grub2: missing unregister call for normal commands may lead to use-after-free

grub2
  • =<2.14
rhcos
NIXPKGS-2025-0016
published 7 months, 3 weeks ago
Permalink CVE-2025-61661
4.8 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Physical (P)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Physical (P)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): High (H)
updated 7 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 8 months, 3 weeks ago
  • @LeSuisse deleted
    4 maintainers
    • @SigmaSquadron
    • @hehongbo
    • @digitalrane
    • @CertainLach
    7 months, 3 weeks ago maintainer.delete
  • @LeSuisse ignored
    2 packages
    • grub2_pvhgrub_image
    • grub2_pvgrub_image
    7 months, 3 weeks ago
  • @LeSuisse accepted 7 months, 3 weeks ago
  • @LeSuisse published on GitHub 7 months, 3 weeks ago

Grub2: out-of-bounds write

grub2
  • =<2.14
rhcos
NIXPKGS-2025-0019
published 7 months, 3 weeks ago
Permalink CVE-2025-54771
4.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 7 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 8 months, 3 weeks ago
  • @LeSuisse ignored
    2 packages
    • grub2_pvgrub_image
    • grub2_pvhgrub_image
    7 months, 3 weeks ago
  • @LeSuisse deleted maintainer @SigmaSquadron 7 months, 3 weeks ago maintainer.delete
  • @LeSuisse added
    2 maintainers
    • @hehongbo
    • @digitalrane
    7 months, 3 weeks ago maintainer.add
  • @LeSuisse deleted
    2 maintainers
    • @hehongbo
    • @digitalrane
    7 months, 3 weeks ago maintainer.delete
  • @LeSuisse accepted 7 months, 3 weeks ago
  • @LeSuisse published on GitHub 7 months, 3 weeks ago

Grub2: use-after-free in grub_file_close()

grub2
  • =<2.14
rhcos
NIXPKGS-2025-0015
published 7 months, 3 weeks ago
Permalink CVE-2025-8396
updated 7 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 10 months, 3 weeks ago
  • @LeSuisse ignored
    14 packages
    • temporal-cli
    • python312Packages.temporalio
    • python313Packages.temporalio
    • haskellPackages.temporal-media
    • terraform-providers.temporalcloud
    • postgresqlPackages.temporal_tables
    • postgresql13Packages.temporal_tables
    • postgresql14Packages.temporal_tables
    • postgresql15Packages.temporal_tables
    • postgresql16Packages.temporal_tables
    • postgresql18Packages.temporal_tables
    • haskellPackages.temporal-music-notation
    • haskellPackages.temporal-music-notation-demo
    • haskellPackages.temporal-music-notation-western
    9 months, 1 week ago
  • @LeSuisse accepted 9 months, 1 week ago
  • @LeSuisse published on GitHub 7 months, 3 weeks ago

Insufficiently specific bounds checking on authorization header could lead to …

temporal
  • <1.28.1
  • <1.26.3
  • <1.27.3
NIXPKGS-2025-0020
published 7 months, 3 weeks ago
Permalink CVE-2025-54770
4.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 7 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 8 months, 3 weeks ago
  • @LeSuisse ignored
    2 packages
    • grub2_pvgrub_image
    • grub2_pvhgrub_image
    7 months, 3 weeks ago
  • @LeSuisse deleted maintainer @SigmaSquadron 7 months, 3 weeks ago maintainer.delete
  • @LeSuisse added
    2 maintainers
    • @hehongbo
    • @digitalrane
    7 months, 3 weeks ago maintainer.add
  • @LeSuisse deleted maintainer @hehongbo 7 months, 3 weeks ago maintainer.delete
  • @LeSuisse added maintainer @CertainLach 7 months, 3 weeks ago maintainer.add
  • @LeSuisse deleted
    2 maintainers
    • @digitalrane
    • @CertainLach
    7 months, 3 weeks ago maintainer.delete
  • @LeSuisse accepted 7 months, 3 weeks ago
  • @LeSuisse published on GitHub 7 months, 3 weeks ago

Grub2: use-after-free in net_set_vlan

grub2
  • =<2.14
rhcos
NIXPKGS-2025-0022
published 7 months, 3 weeks ago
Permalink CVE-2025-11060
5.7 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 7 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 8 months, 3 weeks ago
  • @LeSuisse ignored package surrealdb-migrations 7 months, 3 weeks ago
  • @LeSuisse accepted 7 months, 3 weeks ago
  • @LeSuisse published on GitHub 7 months, 3 weeks ago

Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions

surrealdb
  • <2.3.8
  • <3.3.0-alpha.7
  • <2.1.9
  • <2.2.8
openshift-service-mesh/istio-cni-rhel9
openshift-service-mesh/istio-pilot-rhel9
openshift-service-mesh/istio-proxyv2-rhel9
openshift-service-mesh/istio-rhel9-operator
openshift-service-mesh/istio-must-gather-rhel9
openshift-service-mesh/istio-sail-operator-bundle
openshift-service-mesh-tech-preview/istio-ztunnel-rhel9
openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9