Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-1874
published 3 months, 1 week ago
LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body
Permalink CVE-2026-40930
5.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 3 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 3 months, 1 week ago
  • @LeSuisse ignored
    3 packages
    • libpng12
    • perlPackages.ImagePNGLibpng
    • perl5Packages.ImagePNGLibpng
    3 months, 1 week ago
  • @LeSuisse accepted 3 months, 1 week ago
  • @LeSuisse published on GitHub 3 months, 1 week ago

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

libpng
  • === 1.8.0
libpng-apng
  • ==>= 1.6.49, <= 1.6.57
NIXPKGS-2026-1873
published 3 months, 1 week ago
HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities
Permalink CVE-2026-8829
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 3 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 3 months, 1 week ago
  • @LeSuisse ignored
    2 packages
    • akkuPackages.chibi-html-parser
    • chickenPackages_5.chickenEggs.html-parser
    3 months, 1 week ago
  • @LeSuisse accepted 3 months, 1 week ago
  • @LeSuisse published on GitHub 3 months, 1 week ago

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities

HTML-Parser
  • <3.84
NIXPKGS-2026-1872
published 3 months, 1 week ago
zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash
Permalink CVE-2026-10812
1.1 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
updated 3 months, 1 week ago by @LeSuisse Activity log

zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash

GPTCache
  • ==0.1.30
  • ==0.1.11
  • ==0.1.23
  • ==0.1.21
  • ==0.1.5
  • ==0.1.41
  • ==0.1.12
  • ==0.1.27
  • ==0.1.29
  • ==0.1.33
  • ==0.1.3
  • ==0.1.34
  • ==0.1.14
  • ==0.1.4
  • ==0.1.15
  • ==0.1.13
  • ==0.1.19
  • ==0.1.0
  • ==0.1.32
  • ==0.1.2
  • ==0.1.10
  • ==0.1.28
  • ==0.1.25
  • ==0.1.17
  • ==0.1.24
  • ==0.1.37
  • ==0.1.6
  • ==0.1.16
  • ==0.1.20
  • ==0.1.35
  • ==0.1.44
  • ==0.1.7
  • ==0.1.40
  • ==0.1.31
  • ==0.1.43
  • ==0.1.42
  • ==0.1.22
  • ==0.1.18
  • ==0.1.36
  • ==0.1.26
  • ==0.1.38
  • ==0.1.9
  • ==0.1.1
  • ==0.1.39
  • ==0.1.8
NIXPKGS-2026-1871
published 3 months, 1 week ago
Net::Statsd versions before 0.13 for Perl allow metric injections
Permalink CVE-2026-46739
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 3 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 3 months, 1 week ago
  • @LeSuisse accepted 3 months, 1 week ago
  • @LeSuisse published on GitHub 3 months, 1 week ago

Net::Statsd versions before 0.13 for Perl allow metric injections

Net-Statsd
  • <0.13
NIXPKGS-2026-1870
published 3 months, 1 week ago
Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend
Permalink CVE-2026-10805
6.7 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 3 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 3 months, 1 week ago
  • @LeSuisse ignored
    20 packages
    • networkmanager-ssh
    • networkmanager_strongswan
    • networkmanager-fortisslvpn
    • networkmanager-openconnect
    • kdePackages.networkmanager-qt
    • mobile-broadband-provider-info
    • python313Packages.sdbus-networkmanager
    • python314Packages.sdbus-networkmanager
    • haskellPackages.amazonka-networkmanager
    • python313Packages.mypy-boto3-networkmanager
    • python314Packages.mypy-boto3-networkmanager
    • python313Packages.types-aiobotocore-networkmanager
    • networkmanager-vpnc
    • networkmanager_dmenu
    • networkmanager-iodine
    • networkmanager-openvpn
    • networkmanager-strongswan
    • networkmanager-sstp
    • networkmanagerapplet
    • networkmanager-l2tp
    3 months, 1 week ago
  • @LeSuisse accepted 3 months, 1 week ago
  • @LeSuisse published on GitHub 3 months, 1 week ago

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

NetworkManager
networkmanager
network-manager-applet
NetworkManager-openswan
NetworkManager-libreswan
mobile-broadband-provider-info
redhat-user-workloads/art-images
openshift4/ose-ovn-kubernetes-rhel9
openshift4/kubernetes-nmstate-rhel8-operator
openshift4/kubernetes-nmstate-rhel9-operator
openshift4/ose-ovn-kubernetes-microshift-rhel9
openshift4/ose-kubernetes-nmstate-handler-rhel8
openshift4/ose-kubernetes-nmstate-handler-rhel9
openshift4/ose-aws-cluster-api-controllers-rhel8
openshift4/ose-aws-cluster-api-controllers-rhel9
multicluster-engine/cluster-api-provider-aws-rhel9
NIXPKGS-2026-1869
published 3 months, 1 week ago
Streamlit Palette hashing.py weak hash
Permalink CVE-2026-10804
1.1 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
updated 3 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 3 months, 1 week ago
  • @LeSuisse ignored
    4 references
    3 months, 1 week ago
  • @LeSuisse ignored
    14 packages
    • python313Packages.streamlit-card
    • python314Packages.streamlit-card
    • python313Packages.streamlit-avatar
    • python313Packages.streamlit-folium
    • python313Packages.streamlit-notify
    • python314Packages.streamlit-avatar
    • python314Packages.streamlit-folium
    • python314Packages.streamlit-notify
    • python313Packages.streamlit-echarts
    • python314Packages.streamlit-echarts
    • python313Packages.streamlit-kpi-card
    • python314Packages.streamlit-kpi-card
    • python313Packages.extra-streamlit-components
    • python314Packages.extra-streamlit-components
    3 months, 1 week ago
  • @LeSuisse accepted 3 months, 1 week ago
  • @LeSuisse published on GitHub 3 months, 1 week ago

Streamlit Palette hashing.py weak hash

Streamlit
  • ==1.34
  • ==1.42
  • ==1.2
  • ==1.15
  • ==1.27
  • ==1.21
  • ==1.32
  • ==1.19
  • ==1.4
  • ==1.33
  • ==1.5
  • ==1.43
  • ==1.10
  • ==1.35
  • ==1.18
  • ==1.13
  • ==1.40
  • ==1.48
  • ==1.51
  • ==1.53.0
  • ==1.3
  • ==1.7
  • ==1.9
  • ==1.30
  • ==1.37
  • ==1.52
  • ==1.25
  • ==1.26
  • ==1.22
  • ==1.45
  • ==1.8
  • ==1.38
  • ==1.16
  • ==1.44
  • ==1.36
  • ==1.6
  • ==1.28
  • ==1.23
  • ==1.11
  • ==1.46
  • ==1.0
  • ==1.14
  • ==1.1
  • ==1.50
  • ==1.12
  • ==1.31
  • ==1.24
  • ==1.49
  • ==1.29
  • ==1.20
  • ==1.41
  • ==1.17
  • ==1.39
  • ==1.47
NIXPKGS-2026-1868
published 3 months, 1 week ago
ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on …
Permalink CVE-2026-50031
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 3 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 3 months, 1 week ago
  • @LeSuisse accepted 3 months, 1 week ago
  • @LeSuisse published on GitHub 3 months, 1 week ago

ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on …

FreeIPMI
  • <1.6.18
NIXPKGS-2026-1867
published 3 months, 1 week ago
gradio-app gradio Audio Cache Key save_audio_to_cache weak hash
Permalink CVE-2026-10783
1.1 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
updated 3 months, 1 week ago by @LeSuisse Activity log

gradio-app gradio Audio Cache Key save_audio_to_cache weak hash

gradio
  • ==6.14.0
NIXPKGS-2026-1866
published 3 months, 1 week ago
Cpanel::JSON::XS security issues before 4.41
Permalink CVE-2026-9516
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 3 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 3 months, 1 week ago
  • @LeSuisse accepted 3 months, 1 week ago
  • @LeSuisse published on GitHub 3 months, 1 week ago

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws

Cpanel-JSON-XS
  • <4.41
Permalink CVE-2026-9334
7.3 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 3 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 3 months, 1 week ago
  • @LeSuisse accepted 3 months, 1 week ago
  • @LeSuisse published on GitHub 3 months, 1 week ago

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled

Cpanel-JSON-XS
  • <4.41
NIXPKGS-2026-1865
published 3 months, 1 week ago
Daphne security issues fixed in 4.2.2
Permalink CVE-2026-44545
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 3 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 3 months, 1 week ago
  • @LeSuisse accepted 3 months, 1 week ago
  • @LeSuisse published on GitHub 3 months, 1 week ago

Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service

daphne
  • =<4.2.1
  • ==4.2.2
Permalink CVE-2026-44546
3.7 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 3 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 3 months, 1 week ago
  • @LeSuisse accepted 3 months, 1 week ago
  • @LeSuisse published on GitHub 3 months, 1 week ago

Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing

daphne
  • =<4.2.1
  • ==4.2.2