Nixpkgs security tracker

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-10871

7.3 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): POC (P)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 2 weeks, 6 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 6 days ago
@LeSuisse dismissed (not in Nixpkgs) 2 weeks, 6 days ago

Shibby Tomato Web UI rc start_6rd_tunnel os command injection

A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start_6rd_tunnel of the file /sbin/rc of the component Web UI. Such manipulation of the argument ipv6_6rd_borderrelay leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This project is superseded by FreshTomato.

References

VDB-368361 | Shibby Tomato Web UI rc start_6rd_tunnel os command injection vdb-entrytechnical-description
VDB-368361 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
CVE-2026-10871 | CVE Analysis and Report third-party-advisory
Submit #831857 | Tomato Tomato Firmware Shibby Tomato MIPS32; image d2e251333c48...; /sbin/rc MD5 a48002cdf3cda9452a5b9712edd179d2 OS Command Injection third-party-advisory
https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure… related
https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure… exploit

Affected products

Tomato

==1.28.0000

Matching in nixpkgs

pkgs.tomato-c

Pomodoro timer written in pure C

nixos-unstable 0-unstable-2024-04-19
- nixpkgs-unstable 0-unstable-2024-04-19
- nixos-unstable-small 0-unstable-2024-04-19
nixos-26.05 0-unstable-2024-04-19
- nixos-26.05-small 0-unstable-2024-04-19
- nixpkgs-26.05-darwin 0-unstable-2024-04-19

pkgs.cryptomator

Free client-side encryption for your cloud files

nixos-unstable 1.19.2
- nixpkgs-unstable 1.19.2
- nixos-unstable-small 1.19.2
nixos-26.05 1.19.2
- nixos-26.05-small 1.19.2
- nixpkgs-26.05-darwin 1.19.2

pkgs.cryptomator-cli

Command line program to access encrypted Cryptomator vaults

nixos-unstable 0.6.2
- nixpkgs-unstable 0.6.2
- nixos-unstable-small 0.6.2
nixos-26.05 0.6.2
- nixos-26.05-small 0.6.2
- nixpkgs-26.05-darwin 0.6.2

pkgs.haskellPackages.automaton

Effectful streams and automata in coalgebraic encoding

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5
nixos-26.05 1.5
- nixos-26.05-small 1.5
- nixpkgs-26.05-darwin 1.5

pkgs.haskellPackages.tomato-rubato-openal

Easy to use library for audio programming

nixos-unstable 0.1.0.4
- nixpkgs-unstable 0.1.0.4
- nixos-unstable-small 0.1.0.4
nixos-26.05 0.1.0.4
- nixos-26.05-small 0.1.0.4
- nixpkgs-26.05-darwin 0.1.0.4

Package maintainers

@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
@bachp Pascal Bach <pascal.bach@nextrem.ch>
@masrlinu masrlinu

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-10873

7.3 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): POC (P)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 2 weeks, 6 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 6 days ago
@LeSuisse dismissed (not in Nixpkgs) 2 weeks, 6 days ago

Shibby Tomato Web UI rstats rstats_path os command injection

A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of the file /bin/rstats of the component Web UI. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.

References

VDB-368363 | Shibby Tomato Web UI rstats rstats_path os command injection vdb-entrytechnical-description
VDB-368363 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
CVE-2026-10873 | CVE Analysis and Report third-party-advisory
Submit #831867 | Tomato Tomato by Shibby 1.28.0000 MIPSR2-124 K26 USB Big-VPN command injection third-party-advisory
Submit #831866 | Tomato Tomato by Shibby 1.28.0000 MIPSR2-124 K26 USB Big-VPN command injection (Duplicate) third-party-advisory
https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure… related
https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure… exploitbroken-link

Affected products

Tomato

==1.28.0000

Matching in nixpkgs

pkgs.tomato-c

Pomodoro timer written in pure C

nixos-unstable 0-unstable-2024-04-19
- nixpkgs-unstable 0-unstable-2024-04-19
- nixos-unstable-small 0-unstable-2024-04-19
nixos-26.05 0-unstable-2024-04-19
- nixos-26.05-small 0-unstable-2024-04-19
- nixpkgs-26.05-darwin 0-unstable-2024-04-19

pkgs.cryptomator

Free client-side encryption for your cloud files

nixos-unstable 1.19.2
- nixpkgs-unstable 1.19.2
- nixos-unstable-small 1.19.2
nixos-26.05 1.19.2
- nixos-26.05-small 1.19.2
- nixpkgs-26.05-darwin 1.19.2

pkgs.cryptomator-cli

Command line program to access encrypted Cryptomator vaults

nixos-unstable 0.6.2
- nixpkgs-unstable 0.6.2
- nixos-unstable-small 0.6.2
nixos-26.05 0.6.2
- nixos-26.05-small 0.6.2
- nixpkgs-26.05-darwin 0.6.2

pkgs.haskellPackages.automaton

Effectful streams and automata in coalgebraic encoding

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5
nixos-26.05 1.5
- nixos-26.05-small 1.5
- nixpkgs-26.05-darwin 1.5

pkgs.haskellPackages.tomato-rubato-openal

Easy to use library for audio programming

nixos-unstable 0.1.0.4
- nixpkgs-unstable 0.1.0.4
- nixos-unstable-small 0.1.0.4
nixos-26.05 0.1.0.4
- nixos-26.05-small 0.1.0.4
- nixpkgs-26.05-darwin 0.1.0.4

Package maintainers

@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
@bachp Pascal Bach <pascal.bach@nextrem.ch>
@masrlinu masrlinu

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-10872

7.3 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): POC (P)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 2 weeks, 6 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 6 days ago
@LeSuisse dismissed (not in Nixpkgs) 2 weeks, 6 days ago

Shibby Tomato Web UI rc start_vpnserver os command injection

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.

References

VDB-368362 | Shibby Tomato Web UI rc start_vpnserver os command injection vdb-entrytechnical-description
VDB-368362 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
CVE-2026-10872 | CVE Analysis and Report third-party-advisory
Submit #831858 | Tomato Tomato Firmware Shibby Tomato MIPS32; image d2e251333c48...; /sbin/rc MD5 a48002cdf3cda9452a5b9712edd179d2 OS Command Injection third-party-advisory
https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure… related
https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure… exploit

Affected products

Tomato

==1.28.0000

Matching in nixpkgs

pkgs.tomato-c

Pomodoro timer written in pure C

nixos-unstable 0-unstable-2024-04-19
- nixpkgs-unstable 0-unstable-2024-04-19
- nixos-unstable-small 0-unstable-2024-04-19
nixos-26.05 0-unstable-2024-04-19
- nixos-26.05-small 0-unstable-2024-04-19
- nixpkgs-26.05-darwin 0-unstable-2024-04-19

pkgs.cryptomator

Free client-side encryption for your cloud files

nixos-unstable 1.19.2
- nixpkgs-unstable 1.19.2
- nixos-unstable-small 1.19.2
nixos-26.05 1.19.2
- nixos-26.05-small 1.19.2
- nixpkgs-26.05-darwin 1.19.2

pkgs.cryptomator-cli

Command line program to access encrypted Cryptomator vaults

nixos-unstable 0.6.2
- nixpkgs-unstable 0.6.2
- nixos-unstable-small 0.6.2
nixos-26.05 0.6.2
- nixos-26.05-small 0.6.2
- nixpkgs-26.05-darwin 0.6.2

pkgs.haskellPackages.automaton

Effectful streams and automata in coalgebraic encoding

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5
nixos-26.05 1.5
- nixos-26.05-small 1.5
- nixpkgs-26.05-darwin 1.5

pkgs.haskellPackages.tomato-rubato-openal

Easy to use library for audio programming

nixos-unstable 0.1.0.4
- nixpkgs-unstable 0.1.0.4
- nixos-unstable-small 0.1.0.4
nixos-26.05 0.1.0.4
- nixos-26.05-small 0.1.0.4
- nixpkgs-26.05-darwin 0.1.0.4

Package maintainers

@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
@bachp Pascal Bach <pascal.bach@nextrem.ch>
@masrlinu masrlinu

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-10870

7.3 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): POC (P)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 2 weeks, 6 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 6 days ago
@LeSuisse dismissed (not in Nixpkgs) 2 weeks, 6 days ago

Shibby Tomato Web UI rc start_dhcpc os command injection

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.

References

VDB-368360 | Shibby Tomato Web UI rc start_dhcpc os command injection vdb-entrytechnical-description
VDB-368360 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
CVE-2026-10870 | CVE Analysis and Report third-party-advisory
Submit #831856 | Tomato Tomato Firmware Shibby-modified Tomato Firmware (MIPS32 LE). Verified on extracted image labeled d2e251333c486810d9bbce816021bcf1b93dd392 (inter OS Command Injection third-party-advisory
https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure… related
https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure… exploit

Affected products

Tomato

==1.28.0000

Matching in nixpkgs

pkgs.tomato-c

Pomodoro timer written in pure C

nixos-unstable 0-unstable-2024-04-19
- nixpkgs-unstable 0-unstable-2024-04-19
- nixos-unstable-small 0-unstable-2024-04-19
nixos-26.05 0-unstable-2024-04-19
- nixos-26.05-small 0-unstable-2024-04-19
- nixpkgs-26.05-darwin 0-unstable-2024-04-19

pkgs.cryptomator

Free client-side encryption for your cloud files

nixos-unstable 1.19.2
- nixpkgs-unstable 1.19.2
- nixos-unstable-small 1.19.2
nixos-26.05 1.19.2
- nixos-26.05-small 1.19.2
- nixpkgs-26.05-darwin 1.19.2

pkgs.cryptomator-cli

Command line program to access encrypted Cryptomator vaults

nixos-unstable 0.6.2
- nixpkgs-unstable 0.6.2
- nixos-unstable-small 0.6.2
nixos-26.05 0.6.2
- nixos-26.05-small 0.6.2
- nixpkgs-26.05-darwin 0.6.2

pkgs.haskellPackages.automaton

Effectful streams and automata in coalgebraic encoding

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5
nixos-26.05 1.5
- nixos-26.05-small 1.5
- nixpkgs-26.05-darwin 1.5

pkgs.haskellPackages.tomato-rubato-openal

Easy to use library for audio programming

nixos-unstable 0.1.0.4
- nixpkgs-unstable 0.1.0.4
- nixos-unstable-small 0.1.0.4
nixos-26.05 0.1.0.4
- nixos-26.05-small 0.1.0.4
- nixpkgs-26.05-darwin 0.1.0.4

Package maintainers

@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
@bachp Pascal Bach <pascal.bach@nextrem.ch>
@masrlinu masrlinu

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-10124

7.4 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): POC (P)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 3 weeks, 4 days ago by @LeSuisse Activity log

Created suggestion 3 weeks, 4 days ago
@LeSuisse dismissed (not in Nixpkgs) 3 weeks, 4 days ago

Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow

A vulnerability was determined in Shibby Tomato up to 1.28. Affected is the function rip_zebra_read_ipv4 of the file /usr/sbin/ripd of the component Zserv Handler. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.

References

VDB-367301 | Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow technical-descriptionvdb-entry
VDB-367301 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
Submit #818239 | Tomato by Shibby Tomato Firmware 1.28 Stack-based Buffer Overflow third-party-advisory
https://gitee.com/Fengyi-Wang/CVE/issues/IJ9FFG issue-trackingexploit

Affected products

Tomato

==1.14
==1.0
==1.20
==1.16
==1.27
==1.23
==1.25
==1.28
==1.12
==1.22
==1.3
==1.9
==1.10
==1.17
==1.2
==1.8
==1.15
==1.6
==1.19
==1.21
==1.18
==1.11
==1.7
==1.5
==1.13
==1.4
==1.24
==1.26
==1.1

Matching in nixpkgs

pkgs.tomato-c

Pomodoro timer written in pure C

nixos-unstable 0-unstable-2024-04-19
- nixpkgs-unstable 0-unstable-2024-04-19
- nixos-unstable-small 0-unstable-2024-04-19

pkgs.cryptomator

Free client-side encryption for your cloud files

nixos-unstable 1.19.2
- nixpkgs-unstable 1.19.2
- nixos-unstable-small 1.19.2

pkgs.cryptomator-cli

Command line program to access encrypted Cryptomator vaults

nixos-unstable 0.6.2
- nixpkgs-unstable 0.6.2
- nixos-unstable-small 0.6.2

pkgs.haskellPackages.automaton

Effectful streams and automata in coalgebraic encoding

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5

pkgs.haskellPackages.tomato-rubato-openal

Easy to use library for audio programming

nixos-unstable 0.1.0.4
- nixpkgs-unstable 0.1.0.4
- nixos-unstable-small 0.1.0.4

pkgs.home-assistant-component-tests.tomato

None

Package maintainers

@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
@bachp Pascal Bach <pascal.bach@nextrem.ch>
@masrlinu masrlinu

Untriaged

Permalink CVE-2026-10065

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Not Defined (X)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 3 weeks, 5 days ago Activity log

Created suggestion 3 weeks, 5 days ago

Shibby Tomato tomatodata.cgi get_ups_field stack-based overflow

A weakness has been identified in Shibby Tomato 1.28. This vulnerability affects the function get_ups_field of the file tomatodata.cgi. Executing a manipulation of the argument Date can lead to stack-based buffer overflow. It is possible to launch the attack remotely. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.

References

VDB-367151 | Shibby Tomato tomatodata.cgi get_ups_field stack-based overflow technical-descriptionvdb-entry
VDB-367151 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
Submit #818144 | Tomato by Shibby Tomato Firmware 1.28 Stack-based Buffer Overflow third-party-advisoryexploit
https://gitee.com/Fengyi-Wang/CVE/issues/IJK7BC issue-trackingexploit

Affected products

Tomato

==1.28

Matching in nixpkgs

pkgs.tomato-c

Pomodoro timer written in pure C

nixos-unstable 0-unstable-2024-04-19
- nixpkgs-unstable 0-unstable-2024-04-19
- nixos-unstable-small 0-unstable-2024-04-19

pkgs.cryptomator

Free client-side encryption for your cloud files

nixos-unstable 1.19.2
- nixpkgs-unstable 1.19.2
- nixos-unstable-small 1.19.2

pkgs.cryptomator-cli

Command line program to access encrypted Cryptomator vaults

nixos-unstable 0.6.2
- nixpkgs-unstable 0.6.2
- nixos-unstable-small 0.6.2

pkgs.haskellPackages.automaton

Effectful streams and automata in coalgebraic encoding

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5

pkgs.haskellPackages.tomato-rubato-openal

Easy to use library for audio programming

nixos-unstable 0.1.0.4
- nixpkgs-unstable 0.1.0.4
- nixos-unstable-small 0.1.0.4

pkgs.home-assistant-component-tests.tomato

None

Package maintainers

@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
@bachp Pascal Bach <pascal.bach@nextrem.ch>
@masrlinu masrlinu

Untriaged

Permalink CVE-2026-10068

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Not Defined (X)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 3 weeks, 5 days ago Activity log

Created suggestion 3 weeks, 5 days ago

Shibby Tomato SUBSCRIBE Call miniupnpd send server-side request forgery

A flaw has been found in Shibby Tomato 1.28. The affected element is the function send of the file usr/sbin/miniupnpd of the component SUBSCRIBE Call Handler. This manipulation causes server-side request forgery. The attack may be initiated remotely. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.

References

VDB-367154 | Shibby Tomato SUBSCRIBE Call miniupnpd send server-side request forgery technical-descriptionvdb-entry
VDB-367154 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
Submit #818237 | Tomato by Shibby Tomato Firmware 1.28 Out-of-Bounds Read third-party-advisory
https://gitee.com/Fengyi-Wang/CVE/issues/IJD8SS issue-trackingexploit

Affected products

Tomato

==1.28

Matching in nixpkgs

pkgs.tomato-c

Pomodoro timer written in pure C

nixos-unstable 0-unstable-2024-04-19
- nixpkgs-unstable 0-unstable-2024-04-19
- nixos-unstable-small 0-unstable-2024-04-19

pkgs.cryptomator

Free client-side encryption for your cloud files

nixos-unstable 1.19.2
- nixpkgs-unstable 1.19.2
- nixos-unstable-small 1.19.2

pkgs.cryptomator-cli

Command line program to access encrypted Cryptomator vaults

nixos-unstable 0.6.2
- nixpkgs-unstable 0.6.2
- nixos-unstable-small 0.6.2

pkgs.haskellPackages.automaton

Effectful streams and automata in coalgebraic encoding

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5

pkgs.haskellPackages.tomato-rubato-openal

Easy to use library for audio programming

nixos-unstable 0.1.0.4
- nixpkgs-unstable 0.1.0.4
- nixos-unstable-small 0.1.0.4

pkgs.home-assistant-component-tests.tomato

None

Package maintainers

@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
@bachp Pascal Bach <pascal.bach@nextrem.ch>
@masrlinu masrlinu

Untriaged

Permalink CVE-2026-10069

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Not Defined (X)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 3 weeks, 5 days ago Activity log

Created suggestion 3 weeks, 5 days ago

Shibby Tomato miniupnpd resource consumption

A vulnerability has been found in Shibby Tomato 1.28. The impacted element is an unknown function of the file usr/sbin/miniupnpd. Such manipulation leads to resource consumption. The attack may be launched remotely. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.

References

VDB-367155 | Shibby Tomato miniupnpd resource consumption vdb-entry
VDB-367155 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
Submit #818238 | Tomato by Shibby Tomato Firmware 1.28 Resource Exhaustion third-party-advisory
https://gitee.com/Fengyi-Wang/CVE/issues/IJD8SP issue-tracking

Affected products

Tomato

==1.28

Matching in nixpkgs

pkgs.tomato-c

Pomodoro timer written in pure C

nixos-unstable 0-unstable-2024-04-19
- nixpkgs-unstable 0-unstable-2024-04-19
- nixos-unstable-small 0-unstable-2024-04-19

pkgs.cryptomator

Free client-side encryption for your cloud files

nixos-unstable 1.19.2
- nixpkgs-unstable 1.19.2
- nixos-unstable-small 1.19.2

pkgs.cryptomator-cli

Command line program to access encrypted Cryptomator vaults

nixos-unstable 0.6.2
- nixpkgs-unstable 0.6.2
- nixos-unstable-small 0.6.2

pkgs.haskellPackages.automaton

Effectful streams and automata in coalgebraic encoding

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5

pkgs.haskellPackages.tomato-rubato-openal

Easy to use library for audio programming

nixos-unstable 0.1.0.4
- nixpkgs-unstable 0.1.0.4
- nixos-unstable-small 0.1.0.4

pkgs.home-assistant-component-tests.tomato

None

Package maintainers

@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
@bachp Pascal Bach <pascal.bach@nextrem.ch>
@masrlinu masrlinu

Untriaged

Permalink CVE-2026-10067

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Not Defined (X)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 3 weeks, 5 days ago Activity log

Created suggestion 3 weeks, 5 days ago

Shibby Tomato multimon.cgi sub_90F0 stack-based overflow

A vulnerability was detected in Shibby Tomato 1.28. Impacted is the function sub_90F0 of the file multimon.cgi. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.

References

VDB-367153 | Shibby Tomato multimon.cgi sub_90F0 stack-based overflow technical-descriptionvdb-entry
VDB-367153 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
Submit #818146 | Tomato by Shibby Tomato Firmware 1.28 Stack-based Buffer Overflow third-party-advisory
https://gitee.com/Fengyi-Wang/CVE/issues/IJK7BE issue-tracking

Affected products

Tomato

==1.28

Matching in nixpkgs

pkgs.tomato-c

Pomodoro timer written in pure C

nixos-unstable 0-unstable-2024-04-19
- nixpkgs-unstable 0-unstable-2024-04-19
- nixos-unstable-small 0-unstable-2024-04-19

pkgs.cryptomator

Free client-side encryption for your cloud files

nixos-unstable 1.19.2
- nixpkgs-unstable 1.19.2
- nixos-unstable-small 1.19.2

pkgs.cryptomator-cli

Command line program to access encrypted Cryptomator vaults

nixos-unstable 0.6.2
- nixpkgs-unstable 0.6.2
- nixos-unstable-small 0.6.2

pkgs.haskellPackages.automaton

Effectful streams and automata in coalgebraic encoding

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5

pkgs.haskellPackages.tomato-rubato-openal

Easy to use library for audio programming

nixos-unstable 0.1.0.4
- nixpkgs-unstable 0.1.0.4
- nixos-unstable-small 0.1.0.4

pkgs.home-assistant-component-tests.tomato

None

Package maintainers

@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
@bachp Pascal Bach <pascal.bach@nextrem.ch>
@masrlinu masrlinu

Untriaged

Permalink CVE-2026-10066

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Not Defined (X)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 3 weeks, 5 days ago Activity log

Created suggestion 3 weeks, 5 days ago

Shibby Tomato UPS Service tomatoups.cgi sub_9068 stack-based overflow

A security vulnerability has been detected in Shibby Tomato up to 1.28. This issue affects the function sub_9068 of the file tomatoups.cgi of the component UPS Service. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.

References

VDB-367152 | Shibby Tomato UPS Service tomatoups.cgi sub_9068 stack-based overflow technical-descriptionvdb-entry
VDB-367152 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
Submit #818145 | Tomato by Shibby Tomato Firmware 1.28 Stack-based Buffer Overflow third-party-advisory
https://gitee.com/Fengyi-Wang/CVE/issues/IJK7BD issue-tracking

Affected products

Tomato

==1.14
==1.0
==1.20
==1.16
==1.27
==1.23
==1.25
==1.28
==1.12
==1.22
==1.3
==1.9
==1.10
==1.17
==1.2
==1.8
==1.15
==1.6
==1.19
==1.21
==1.18
==1.11
==1.7
==1.5
==1.13
==1.4
==1.24
==1.26
==1.1

Matching in nixpkgs

pkgs.tomato-c

Pomodoro timer written in pure C

nixos-unstable 0-unstable-2024-04-19
- nixpkgs-unstable 0-unstable-2024-04-19
- nixos-unstable-small 0-unstable-2024-04-19

pkgs.cryptomator

Free client-side encryption for your cloud files

nixos-unstable 1.19.2
- nixpkgs-unstable 1.19.2
- nixos-unstable-small 1.19.2

pkgs.cryptomator-cli

Command line program to access encrypted Cryptomator vaults

nixos-unstable 0.6.2
- nixpkgs-unstable 0.6.2
- nixos-unstable-small 0.6.2

pkgs.haskellPackages.automaton

Effectful streams and automata in coalgebraic encoding

nixos-unstable 1.5
- nixpkgs-unstable 1.5
- nixos-unstable-small 1.5

pkgs.haskellPackages.tomato-rubato-openal

Easy to use library for audio programming

nixos-unstable 0.1.0.4
- nixpkgs-unstable 0.1.0.4
- nixos-unstable-small 0.1.0.4

pkgs.home-assistant-component-tests.tomato

None

Package maintainers

@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
@bachp Pascal Bach <pascal.bach@nextrem.ch>
@masrlinu masrlinu

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.tomato-c

pkgs.cryptomator

pkgs.cryptomator-cli

pkgs.haskellPackages.automaton

pkgs.haskellPackages.tomato-rubato-openal

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.tomato-c

pkgs.cryptomator

pkgs.cryptomator-cli

pkgs.haskellPackages.automaton

pkgs.haskellPackages.tomato-rubato-openal

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.tomato-c

pkgs.cryptomator

pkgs.cryptomator-cli

pkgs.haskellPackages.automaton

pkgs.haskellPackages.tomato-rubato-openal

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.tomato-c

pkgs.cryptomator

pkgs.cryptomator-cli

pkgs.haskellPackages.automaton

pkgs.haskellPackages.tomato-rubato-openal

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.tomato-c

pkgs.cryptomator

pkgs.cryptomator-cli

pkgs.haskellPackages.automaton

pkgs.haskellPackages.tomato-rubato-openal

pkgs.home-assistant-component-tests.tomato

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.tomato-c

pkgs.cryptomator

pkgs.cryptomator-cli

pkgs.haskellPackages.automaton

pkgs.haskellPackages.tomato-rubato-openal

pkgs.home-assistant-component-tests.tomato

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.tomato-c

pkgs.cryptomator

pkgs.cryptomator-cli

pkgs.haskellPackages.automaton

pkgs.haskellPackages.tomato-rubato-openal

pkgs.home-assistant-component-tests.tomato

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.tomato-c

pkgs.cryptomator

pkgs.cryptomator-cli

pkgs.haskellPackages.automaton

pkgs.haskellPackages.tomato-rubato-openal

pkgs.home-assistant-component-tests.tomato

Package maintainers

References

Affected products

Matching in nixpkgs