Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0339
published 7 months ago
Permalink CVE-2026-24004
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored
    20 packages
    • fleetctl
    • fleeting-plugin-aws
    • azure-cli-extensions.fleet
    • python312Packages.tesla-fleet-api
    • python313Packages.tesla-fleet-api
    • python314Packages.tesla-fleet-api
    • haskellPackages.amazonka-iotfleethub
    • haskellPackages.amazonka-iotfleetwise
    • python312Packages.mypy-boto3-iotfleethub
    • python313Packages.mypy-boto3-iotfleethub
    • python314Packages.mypy-boto3-iotfleethub
    • python312Packages.mypy-boto3-iotfleetwise
    • python313Packages.mypy-boto3-iotfleetwise
    • python314Packages.mypy-boto3-iotfleetwise
    • home-assistant-component-tests.tesla_fleet
    • python312Packages.types-aiobotocore-iotfleethub
    • python313Packages.types-aiobotocore-iotfleethub
    • python312Packages.types-aiobotocore-iotfleetwise
    • python313Packages.types-aiobotocore-iotfleetwise
    • tests.home-assistant-component-tests.tesla_fleet
    7 months ago
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint

fleet
  • ==< 4.80.1 
Upstream advisory: https://github.com/fleetdm/fleet/security/advisories/GHSA-9pm7-6g36-6j78
NIXPKGS-2026-0362
published 7 months ago
Permalink CVE-2026-25952
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo

FreeRDP
  • ==< 3.23.0 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5
NIXPKGS-2026-0360
published 7 months ago
Permalink CVE-2026-25941
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

FreeRDP: vuln_1_15_1 RDPGFX WIRE_TO_SURFACE_2 Out-of-Bounds Read

FreeRDP
  • ==>= 3.0.0, < 3.23.0
  • ==>= 2.0.0, < 2.11.8 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3546-x645-5cf8
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/2e3b77e28ac6a398897d28ba464dcc5dfab9c9e2
NIXPKGS-2026-0358
published 7 months ago
Permalink CVE-2026-27950
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File

FreeRDP
  • ==< 3.23.0 
Upstream advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rvfg-86cr-5r6p
Upstream patches:
* https://github.com/FreeRDP/FreeRDP/commit/c42ecbd183b001e76bfc3614cddfad0034acc758
* https://github.com/FreeRDP/FreeRDP/commit/5f62aa11c1bdf00f94c40ea9ebb260a752740b80
NIXPKGS-2026-0457
published 7 months ago
Permalink CVE-2026-24484
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse deleted
    3 maintainers
    • @faukah
    • @dotlambda
    • @rhendric
    7 months ago maintainer.delete
  • @LeSuisse ignored
    3 packages
    • graphicsmagick-imagemagick-compat
    • tests.pkg-config.defaultPkgConfigPackages.MagickWand
    • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
    7 months ago
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

ImageMagick
  • ==>= 7.0.0, < 7.1.2-15
  • ==< 6.9.13-40
NIXPKGS-2026-0456
published 7 months ago
Permalink CVE-2026-26284
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored
    3 packages
    • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
    • tests.pkg-config.defaultPkgConfigPackages.MagickWand
    • graphicsmagick-imagemagick-compat
    7 months ago
  • @LeSuisse deleted
    3 maintainers
    • @faukah
    • @dotlambda
    • @rhendric
    7 months ago maintainer.delete
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

ImageMagick has heap overflow in pcd decoder that leads to out of bounds read.

ImageMagick
  • ==>= 7.0.0, < 7.1.2-15
  • ==< 6.9.13-40
NIXPKGS-2026-0455
published 7 months ago
Permalink CVE-2026-25969
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored
    3 packages
    • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
    • tests.pkg-config.defaultPkgConfigPackages.MagickWand
    • graphicsmagick-imagemagick-compat
    7 months ago
  • @LeSuisse deleted
    3 maintainers
    • @faukah
    • @dotlambda
    • @rhendric
    7 months ago maintainer.delete
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

ImageMagick has Memory Leak in coders/ashlar.c

ImageMagick
  • ==< 7.1.2-15
NIXPKGS-2026-0454
published 7 months ago
Permalink CVE-2026-25965
8.6 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored
    3 packages
    • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
    • tests.pkg-config.defaultPkgConfigPackages.MagickWand
    • graphicsmagick-imagemagick-compat
    7 months ago
  • @LeSuisse deleted
    3 maintainers
    • @faukah
    • @dotlambda
    • @rhendric
    7 months ago maintainer.delete
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

ImageMagick's policy bypass through path traversal allows reading restricted content despite secured policy

ImageMagick
  • ==>= 7.0.0, < 7.1.2-15
  • ==< 6.9.13-40
NIXPKGS-2026-0453
published 7 months ago
Permalink CVE-2026-24485
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored
    3 packages
    • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
    • tests.pkg-config.defaultPkgConfigPackages.MagickWand
    • graphicsmagick-imagemagick-compat
    7 months ago
  • @LeSuisse deleted
    3 maintainers
    • @faukah
    • @rhendric
    • @dotlambda
    7 months ago maintainer.delete
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

ImageMagick: Infinite loop vulnerability when parsing a PCD file

ImageMagick
  • ==>= 7.0.0, < 7.1.2-15
  • ==< 6.9.13-40
NIXPKGS-2026-0458
published 7 months ago
Permalink CVE-2026-26983
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 7 months ago by @LeSuisse Activity log
  • Created suggestion 7 months ago
  • @LeSuisse ignored
    3 packages
    • graphicsmagick-imagemagick-compat
    • tests.pkg-config.defaultPkgConfigPackages.MagickWand
    • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
    7 months ago
  • @LeSuisse deleted
    3 maintainers
    • @faukah
    • @rhendric
    • @dotlambda
    7 months ago maintainer.delete
  • @LeSuisse accepted 7 months ago
  • @LeSuisse published on GitHub 7 months ago

ImageMagick: Invalid MSL <map> can result in a use after free

ImageMagick
  • ==>= 7.0.0, < 7.1.2-15
  • ==< 6.9.13-40