Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: boost

Found 5 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-18495
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): High (H)
created 5 days, 8 hours ago Activity log
  • Created suggestion 5 days, 8 hours ago
Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Affected products

ceph
boost
libtiff
libtiff-main
  • *
mingw-libtiff
compat-libtiff3

Matching in nixpkgs

pkgs.booster

Fast and secure initramfs generator

  • nixos-unstable 0.12
    • nixpkgs-unstable 0.12
    • nixos-unstable-small 0.12
  • nixos-26.05 0.12
    • nixos-26.05-small 0.12
    • nixpkgs-26.05-darwin 0.12

pkgs.calceph

C library for interacting with binary planetary ephemeris files, such INPOPxx, JPL DExxx and SPICE

pkgs.libtiff

Library and utilities for working with the TIFF image file format

pkgs.xgboost

Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library

pkgs.boost191

Collection of C++ libraries

  • nixos-unstable -

pkgs.catboost

High-performance library for gradient boosting on decision trees

pkgs.ceph-csi

Container Storage Interface (CSI) driver for Ceph RBD and CephFS

pkgs.boost-sml

Header only state machine library with no dependencies

pkgs.mev-boost

Ethereum block-building middleware

  • nixos-unstable 1.12
    • nixpkgs-unstable 1.12
    • nixos-unstable-small 1.12
  • nixos-26.05 1.12
    • nixos-26.05-small 1.12
    • nixpkgs-26.05-darwin 1.12

pkgs.xgboostWithCuda

Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library

Package maintainers

Untriaged
Permalink CVE-2026-32556
7.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
created 3 weeks, 2 days ago Activity log
  • Created suggestion 3 weeks, 2 days ago
WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.

Affected products

boost
  • =<2.0.4

Matching in nixpkgs

pkgs.booster

Fast and secure initramfs generator

  • nixos-unstable 0.12
    • nixpkgs-unstable 0.12
    • nixos-unstable-small 0.12
  • nixos-26.05 0.12
    • nixos-26.05-small 0.12
    • nixpkgs-26.05-darwin 0.12

pkgs.xgboost

Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library

pkgs.boost191

Collection of C++ libraries

  • nixos-unstable -

pkgs.catboost

High-performance library for gradient boosting on decision trees

pkgs.boost-sml

Header only state machine library with no dependencies

pkgs.mev-boost

Ethereum block-building middleware

  • nixos-unstable 1.12
    • nixpkgs-unstable 1.12
    • nixos-unstable-small 1.12
  • nixos-26.05 1.12
    • nixos-26.05-small 1.12
    • nixpkgs-26.05-darwin 1.12

pkgs.xgboostWithCuda

Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library

Untriaged
Permalink CVE-2026-32555
9.3 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
created 3 weeks, 2 days ago Activity log
  • Created suggestion 3 weeks, 2 days ago
WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in Boost <= 2.0.4 versions.

Affected products

boost
  • =<2.0.4

Matching in nixpkgs

pkgs.booster

Fast and secure initramfs generator

  • nixos-unstable 0.12
    • nixpkgs-unstable 0.12
    • nixos-unstable-small 0.12
  • nixos-26.05 0.12
    • nixos-26.05-small 0.12
    • nixpkgs-26.05-darwin 0.12

pkgs.xgboost

Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library

pkgs.boost191

Collection of C++ libraries

  • nixos-unstable -

pkgs.catboost

High-performance library for gradient boosting on decision trees

pkgs.boost-sml

Header only state machine library with no dependencies

pkgs.mev-boost

Ethereum block-building middleware

  • nixos-unstable 1.12
    • nixpkgs-unstable 1.12
    • nixos-unstable-small 1.12
  • nixos-26.05 1.12
    • nixos-26.05-small 1.12
    • nixpkgs-26.05-darwin 1.12

pkgs.xgboostWithCuda

Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-9010
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 3 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 3 months, 3 weeks ago
  • @LeSuisse dismissed (not in Nixpkgs) 3 months, 3 weeks ago
Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters

The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected products

Boost
  • =<2.0.3

Matching in nixpkgs

pkgs.boost

Collection of C++ libraries

pkgs.booster

Fast and secure initramfs generator

  • nixos-unstable 0.12
    • nixos-unstable-small 0.12

pkgs.xgboost

Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library

pkgs.catboost

High-performance library for gradient boosting on decision trees

pkgs.boost-sml

Header only state machine library with no dependencies

pkgs.mev-boost

Ethereum block-building middleware

  • nixos-unstable 1.12
    • nixos-unstable-small 1.12

pkgs.xgboostWithCuda

Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library

pkgs.gnomeExtensions.volume-boost

A toggle to Boosts volume above limits | Fork of https://github.com/shaquibimdad/gnome_ext_volume_boost

  • nixos-unstable 8
    • nixos-unstable-small 8
Dismissed
(not in Nixpkgs)
Permalink CVE-2026-7637
9.8 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 3 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 3 months, 3 weeks ago
  • @LeSuisse dismissed (not in Nixpkgs) 3 months, 3 weeks ago
Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie

The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

Affected products

Boost
  • =<2.0.3

Matching in nixpkgs

pkgs.boost

Collection of C++ libraries

pkgs.booster

Fast and secure initramfs generator

  • nixos-unstable 0.12
    • nixos-unstable-small 0.12

pkgs.xgboost

Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library

pkgs.catboost

High-performance library for gradient boosting on decision trees

pkgs.boost-sml

Header only state machine library with no dependencies

pkgs.mev-boost

Ethereum block-building middleware

  • nixos-unstable 1.12
    • nixos-unstable-small 1.12

pkgs.xgboostWithCuda

Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library

pkgs.gnomeExtensions.volume-boost

A toggle to Boosts volume above limits | Fork of https://github.com/shaquibimdad/gnome_ext_volume_boost

  • nixos-unstable 8
    • nixos-unstable-small 8