Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0004
published 8 months, 2 weeks ago
Permalink CVE-2025-69194
8.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 8 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 8 months, 2 weeks ago
  • @LeSuisse deleted maintainer @SuperSandro2000 8 months, 2 weeks ago maintainer.delete
  • @LeSuisse accepted 8 months, 2 weeks ago
  • @LeSuisse published on GitHub 8 months, 2 weeks ago

Wget2: arbitrary file write via metalink path traversal in gnu wget2

wget2
  • ==2.2.1
  • =<2.2.0
NIXPKGS-2025-0023
published 9 months ago
Permalink CVE-2025-11683
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Adjacent (A)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Adjacent (A)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 8 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 10 months, 1 week ago
  • @LeSuisse accepted 8 months, 4 weeks ago
  • @LeSuisse published on GitHub 8 months, 4 weeks ago

YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure

YAML-Syck
  • <1.36
NIXPKGS-2025-0017
published 9 months, 1 week ago
Permalink CVE-2025-61663
4.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 9 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 10 months, 1 week ago
  • @LeSuisse deleted
    4 maintainers
    • @SigmaSquadron
    • @hehongbo
    • @digitalrane
    • @CertainLach
    9 months, 1 week ago maintainer.delete
  • @LeSuisse ignored
    2 packages
    • grub2_pvgrub_image
    • grub2_pvhgrub_image
    9 months, 1 week ago
  • @LeSuisse accepted 9 months, 1 week ago
  • @LeSuisse published on GitHub 9 months, 1 week ago

Grub2: missing unregister call for normal commands may lead to use-after-free

grub2
  • =<2.14
rhcos
NIXPKGS-2025-0022
published 9 months, 1 week ago
Permalink CVE-2025-11060
5.7 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 9 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 10 months, 1 week ago
  • @LeSuisse ignored package surrealdb-migrations 9 months, 1 week ago
  • @LeSuisse accepted 9 months, 1 week ago
  • @LeSuisse published on GitHub 9 months, 1 week ago

Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions

surrealdb
  • <2.3.8
  • <3.3.0-alpha.7
  • <2.1.9
  • <2.2.8
openshift-service-mesh/istio-cni-rhel9
openshift-service-mesh/istio-pilot-rhel9
openshift-service-mesh/istio-proxyv2-rhel9
openshift-service-mesh/istio-rhel9-operator
openshift-service-mesh/istio-must-gather-rhel9
openshift-service-mesh/istio-sail-operator-bundle
openshift-service-mesh-tech-preview/istio-ztunnel-rhel9
openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9
NIXPKGS-2025-0020
published 9 months, 1 week ago
Permalink CVE-2025-54770
4.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 9 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 10 months, 1 week ago
  • @LeSuisse ignored
    2 packages
    • grub2_pvgrub_image
    • grub2_pvhgrub_image
    9 months, 1 week ago
  • @LeSuisse deleted maintainer @SigmaSquadron 9 months, 1 week ago maintainer.delete
  • @LeSuisse added
    2 maintainers
    • @hehongbo
    • @digitalrane
    9 months, 1 week ago maintainer.add
  • @LeSuisse deleted maintainer @hehongbo 9 months, 1 week ago maintainer.delete
  • @LeSuisse added maintainer @CertainLach 9 months, 1 week ago maintainer.add
  • @LeSuisse deleted
    2 maintainers
    • @digitalrane
    • @CertainLach
    9 months, 1 week ago maintainer.delete
  • @LeSuisse accepted 9 months, 1 week ago
  • @LeSuisse published on GitHub 9 months, 1 week ago

Grub2: use-after-free in net_set_vlan

grub2
  • =<2.14
rhcos
NIXPKGS-2025-0019
published 9 months, 1 week ago
Permalink CVE-2025-54771
4.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 9 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 10 months, 1 week ago
  • @LeSuisse ignored
    2 packages
    • grub2_pvgrub_image
    • grub2_pvhgrub_image
    9 months, 1 week ago
  • @LeSuisse deleted maintainer @SigmaSquadron 9 months, 1 week ago maintainer.delete
  • @LeSuisse added
    2 maintainers
    • @hehongbo
    • @digitalrane
    9 months, 1 week ago maintainer.add
  • @LeSuisse deleted
    2 maintainers
    • @hehongbo
    • @digitalrane
    9 months, 1 week ago maintainer.delete
  • @LeSuisse accepted 9 months, 1 week ago
  • @LeSuisse published on GitHub 9 months, 1 week ago

Grub2: use-after-free in grub_file_close()

grub2
  • =<2.14
rhcos
NIXPKGS-2025-0018
published 9 months, 1 week ago
Permalink CVE-2025-61662
4.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 9 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 10 months, 1 week ago
  • @LeSuisse deleted
    4 maintainers
    • @SigmaSquadron
    • @hehongbo
    • @digitalrane
    • @CertainLach
    9 months, 1 week ago maintainer.delete
  • @LeSuisse ignored
    2 packages
    • grub2_pvhgrub_image
    • grub2_pvgrub_image
    9 months, 1 week ago
  • @LeSuisse accepted 9 months, 1 week ago
  • @LeSuisse published on GitHub 9 months, 1 week ago

Grub2: missing unregister call for gettext command may lead to use-after-free

grub2
  • =<2.14
rhcos
NIXPKGS-2025-0021
published 9 months, 1 week ago
Permalink CVE-2025-61664
4.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 9 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 10 months, 1 week ago
  • @LeSuisse ignored
    2 packages
    • grub2_pvgrub_image
    • grub2_pvhgrub_image
    9 months, 1 week ago
  • @LeSuisse deleted maintainer @SigmaSquadron 9 months, 1 week ago maintainer.delete
  • @LeSuisse added
    3 maintainers
    • @hehongbo
    • @digitalrane
    • @CertainLach
    9 months, 1 week ago maintainer.add
  • @LeSuisse deleted
    3 maintainers
    • @hehongbo
    • @digitalrane
    • @CertainLach
    9 months, 1 week ago maintainer.delete
  • @LeSuisse accepted 9 months, 1 week ago
  • @LeSuisse published on GitHub 9 months, 1 week ago

Grub2: missing unregister call for normal_exit command may lead to use-after-free

grub2
  • =<2.14
rhcos
NIXPKGS-2025-0014
published 9 months, 1 week ago
Permalink CVE-2025-13502
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 9 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 10 months ago
  • @LeSuisse ignored
    5 packages
    • tests.pkg-config.defaultPkgConfigPackages."webkit2gtk-4.0"
    • obs-studio-plugins.obs-webkitgtk
    • haskellPackages.webkit2gtk3-javascriptcore
    • tests.pkg-config.defaultPkgConfigPackages."javascriptcoregtk-4.0"
    • tests.pkg-config.defaultPkgConfigPackages."webkit2gtk-web-extension-4.0"
    9 months, 1 week ago
  • @LeSuisse deleted
    4 maintainers
    • @jtojnar
    • @bobby285271
    • @hedning
    • @dasj19
    9 months, 1 week ago maintainer.delete
  • @LeSuisse accepted 9 months, 1 week ago
  • @LeSuisse published on GitHub 9 months, 1 week ago

Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos

webkitgtk
  • <2.50.2
webkitgtk3
webkitgtk4
  • *
webkit2gtk3
  • *
NIXPKGS-2025-0015
published 9 months, 1 week ago
Permalink CVE-2025-8396
updated 9 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 1 year ago
  • @LeSuisse ignored
    14 packages
    • temporal-cli
    • python312Packages.temporalio
    • python313Packages.temporalio
    • haskellPackages.temporal-media
    • terraform-providers.temporalcloud
    • postgresqlPackages.temporal_tables
    • postgresql13Packages.temporal_tables
    • postgresql14Packages.temporal_tables
    • postgresql15Packages.temporal_tables
    • postgresql16Packages.temporal_tables
    • postgresql18Packages.temporal_tables
    • haskellPackages.temporal-music-notation
    • haskellPackages.temporal-music-notation-demo
    • haskellPackages.temporal-music-notation-western
    10 months, 3 weeks ago
  • @LeSuisse accepted 10 months, 3 weeks ago
  • @LeSuisse published on GitHub 9 months, 1 week ago

Insufficiently specific bounds checking on authorization header could lead to …

temporal
  • <1.28.1
  • <1.26.3
  • <1.27.3