Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestions search

All statuses
Filter by:
With package: python313Packages.pymsteams

Found 5 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-100582
7.1 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 3 hours ago Activity log
  • Created suggestion 3 hours ago
OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass

OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-trust sender or a steered agent with access to a channel read action can therefore retrieve content or metadata from channels or rooms excluded by the operator's read policy; the practical impact depends on the permissions held by the connected bot account. The issue is fixed in 2026.8.1.

Affected products

feishu
  • <2026.8.1
  • ==2026.8.1
matrix
  • <2026.8.1
  • ==2026.8.1
msteams
  • <2026.8.1
  • ==2026.8.1
googlechat
  • <2026.8.1
  • ==2026.8.1

Matching in nixpkgs

pkgs.feishu

All-in-one collaboration suite

  • nixos-unstable -
  • nixos-26.05 -

pkgs.cmatrix

Simulates the falling characters theme from The Matrix movie

  • nixos-unstable -
    • nixos-unstable-small 2.0
  • nixos-26.05 -
    • nixos-26.05-small 2.0

pkgs.rmatrix

Digital rain for modern terminals

  • nixos-unstable -
    • nixos-unstable-small 0.3.3

pkgs.tmatrix

Terminal based replica of the digital rain from The Matrix

  • nixos-unstable -
    • nixos-unstable-small 1.4
  • nixos-26.05 -
    • nixos-26.05-small 1.4

pkgs.dendrite

Second-generation Matrix homeserver written in Go

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gomatrix

Displays "The Matrix" in a terminal

  • nixos-unstable -
  • nixos-26.05 -

pkgs.feishu-cli

CLI for Feishu (Lark) Open Platform

  • nixos-unstable -
  • nixos-26.05 -

pkgs.libcmatrix

Matrix protocol library written in C using GObject

  • nixos-unstable -
    • nixos-unstable-small 0.0.4
  • nixos-26.05 -
    • nixos-26.05-small 0.0.4

pkgs.matrix-hook

Simple webhook for matrix

  • nixos-unstable -
    • nixos-unstable-small 1.0.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.0

pkgs.matrix-brandy

Matrix Brandy BASIC VI for Linux, Windows, MacOSX

  • nixos-unstable -
  • nixos-26.05 -

pkgs.matrix-conduit

Matrix homeserver written in Rust

  • nixos-unstable -
  • nixos-26.05 -

pkgs.matrix-tuwunel

Matrix homeserver written in Rust, official successor to conduwuit

  • nixos-unstable -
    • nixos-unstable-small 1.9.3
  • nixos-26.05 -
    • nixos-26.05-small 1.9.1

pkgs.matrix-corporal

Reconciliator and gateway for a managed Matrix server

  • nixos-unstable -
    • nixos-unstable-small 2.2.0
  • nixos-26.05 -
    • nixos-26.05-small 2.2.0

pkgs.matrix-hookshot

Bridge between Matrix and multiple project management services, such as GitHub, GitLab and JIRA

  • nixos-unstable -
    • nixos-unstable-small 7.5.0
  • nixos-26.05 -
    • nixos-26.05-small 7.5.0

pkgs.matrix-commander

Simple but convenient CLI-based Matrix client app for sending and receiving

  • nixos-unstable -
    • nixos-unstable-small 8.0.5
  • nixos-26.05 -
    • nixos-26.05-small 8.0.5

pkgs.matrix-media-repo

Highly configurable multi-domain media repository for Matrix

  • nixos-unstable -
    • nixos-unstable-small 1.3.8
  • nixos-26.05 -
    • nixos-26.05-small 1.3.8

pkgs.mautrix-googlechat

Matrix-Google Chat puppeting bridge

  • nixos-unstable -
    • nixos-unstable-small 0.5.2
  • nixos-26.05 -
    • nixos-26.05-small 0.5.2

pkgs.matrix-alertmanager

Bot to receive Alertmanager webhook events and forward them to chosen rooms

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 0.9.0

pkgs.matrix-commander-rs

CLI-based Matrix client app for sending and receiving

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 1.0.0

pkgs.matrix-continuwuity

Matrix homeserver written in Rust, forked from conduwuit

  • nixos-unstable -
  • nixos-26.05 -

pkgs.matrix-zulip-bridge

Matrix puppeting appservice bridge for Zulip

  • nixos-unstable -
    • nixos-unstable-small 0.4.1
  • nixos-26.05 -
    • nixos-26.05-small 0.4.1

pkgs.python313Packages.canmatrix

Support and convert several CAN (Controller Area Network) database formats

  • nixos-unstable -
    • nixos-unstable-small 1.2
  • nixos-26.05 -
    • nixos-26.05-small 1.2

pkgs.python314Packages.canmatrix

Support and convert several CAN (Controller Area Network) database formats

  • nixos-unstable -
    • nixos-unstable-small 1.2
  • nixos-26.05 -
    • nixos-26.05-small 1.2

pkgs.gnomeExtensions.workspace-matrix

Arrange workspaces in a two dimensional grid with workspace thumbnails.

  • nixos-unstable -
    • nixos-unstable-small 53
  • nixos-26.05 -
    • nixos-26.05-small 53

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-95592
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 2 days, 23 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 3 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 2 days, 23 hours ago
WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.

Affected products

tlp-team
  • =<6.0.0

Matching in nixpkgs

pkgs.steam

Digital distribution platform

  • nixos-unstable -
  • nixos-26.05 -

pkgs.git-team

Command line interface for managing and enhancing git commit messages with co-authors

  • nixos-unstable -
    • nixos-unstable-small 2.0.0
  • nixos-26.05 -
    • nixos-26.05-small 1.8.1

pkgs.steamcmd

Steam command-line tools

  • nixos-unstable -
  • nixos-26.05 -

pkgs.teamocil

Simple tool used to automatically create windows and panes in tmux with YAML files

  • nixos-unstable -
    • nixos-unstable-small 1.4.2
  • nixos-26.05 -
    • nixos-26.05-small 1.4.2

pkgs.teamtype

Real-time co-editing of local text files

  • nixos-unstable -
    • nixos-unstable-small 0.9.2
  • nixos-26.05 -
    • nixos-26.05-small 0.9.2

pkgs.ethersync

Real-time co-editing of local text files

  • nixos-unstable -
    • nixos-unstable-small 0.9.2
  • nixos-26.05 -
    • nixos-26.05-small 0.9.2

pkgs.steam-acf

Tool to convert Steam .acf files to JSON

  • nixos-unstable -
    • nixos-unstable-small 0.1.0
  • nixos-26.05 -
    • nixos-26.05-small 0.1.0

pkgs.steam-run

Run commands in the same FHS environment that is used for Steam

  • nixos-unstable -
  • nixos-26.05 -

pkgs.steam-tui

Rust TUI client for steamcmd

  • nixos-unstable -
    • nixos-unstable-small 0.3.0
  • nixos-26.05 -
    • nixos-26.05-small 0.3.0

pkgs.steamback

Decky plugin to add versioned save-game snapshots to Steam-cloud enabled games

  • nixos-unstable -
    • nixos-unstable-small 0.3.6
  • nixos-26.05 -
    • nixos-26.05-small 0.3.6

pkgs.steampipe

Dynamically query your cloud, code, logs & more with SQL

  • nixos-unstable -
    • nixos-unstable-small 2.4.7
  • nixos-26.05 -
    • nixos-26.05-small 2.4.5

pkgs.steamworks

Configuration information distributed over LDAP in near realtime

  • nixos-unstable -
  • nixos-26.05 -

pkgs.teamviewer

Desktop sharing application, providing remote support and online meetings

  • nixos-unstable -
  • nixos-26.05 -

pkgs.adwsteamgtk

Simple Gtk wrapper for Adwaita-for-Steam

  • nixos-unstable -
    • nixos-unstable-small 0.8.0
  • nixos-26.05 -
    • nixos-26.05-small 0.8.0

pkgs.bitlbee-steam

Steam protocol plugin for BitlBee

  • nixos-unstable -
    • nixos-unstable-small 1.4.2
  • nixos-26.05 -
    • nixos-26.05-small 1.4.2

pkgs.ArchiSteamFarm

Application with primary purpose of idling Steam cards from multiple accounts simultaneously

  • nixos-unstable -
  • nixos-26.05 -

pkgs.archisteamfarm

Application with primary purpose of idling Steam cards from multiple accounts simultaneously

  • nixos-unstable -
  • nixos-26.05 -

pkgs.steam-run-free

Run commands in the same FHS environment that is used for Steam

  • nixos-unstable -
  • nixos-26.05 -

pkgs.steamguard-cli

Linux utility for generating 2FA codes for Steam and managing Steam trade confirmations

  • nixos-unstable -
  • nixos-26.05 -

pkgs.teams-for-linux

Unofficial Microsoft Teams client for Linux

  • nixos-unstable -
  • nixos-26.05 -

pkgs.teamspeak_server

TeamSpeak voice communication server

  • nixos-unstable -
  • nixos-26.05 -

pkgs.steam-art-manager

A tool to manage and change Steam library artwork

  • nixos-unstable -
  • nixos-26.05 -

pkgs.steamvr-linux-fixes

Vulkan layer that patches SteamVR vrcompositor for wired HMDs

  • nixos-unstable -
    • nixos-unstable-small 0.1.4

pkgs.vimPlugins.teamtype

Real-time co-editing of local text files

  • nixos-unstable -
    • nixos-unstable-small 0.9.2
  • nixos-26.05 -
    • nixos-26.05-small 0.9.2

pkgs.steam-lancache-prefill

Automatically fills a Lancache with games from Steam

  • nixos-unstable -
    • nixos-unstable-small 3.6.1
  • nixos-26.05 -
    • nixos-26.05-small 3.4.2

pkgs.python313Packages.steamodd

High level Steam API implementation with low level reusable core

  • nixos-unstable -
    • nixos-unstable-small 5.0
  • nixos-26.05 -
    • nixos-26.05-small 5.0

pkgs.python314Packages.steamodd

High level Steam API implementation with low level reusable core

  • nixos-unstable -
    • nixos-unstable-small 5.0
  • nixos-26.05 -
    • nixos-26.05-small 5.0

pkgs.gnomeExtensions.add-to-steam

Add executables to steam without having to open, or restart steam; Just like SteamOS.

  • nixos-unstable -
    • nixos-unstable-small 4
  • nixos-26.05 -
    • nixos-26.05-small 3

Package maintainers

Untriaged
Permalink CVE-2026-62213
6.0 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 2 months ago Activity log
  • Created suggestion 2 months ago
OpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound Requests

OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials that should remain within the trusted boundary.

Affected products

msteams
  • <2026.5.27
  • ==2026.5.27

Matching in nixpkgs

Untriaged
Permalink CVE-2026-62214
6.0 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 2 months ago Activity log
  • Created suggestion 2 months ago
OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation

OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured input paths to retrieve sensitive authentication data outside the trusted boundary.

Affected products

msteams
  • ==2026.5.28
  • <2026.5.28

Matching in nixpkgs

Untriaged
Permalink CVE-2026-62224
2.3 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 2 months ago Activity log
  • Created suggestion 2 months ago
OpenClaw MS Teams < 2026.5.12 Authorization Bypass

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected feature.

Affected products

msteams
  • <2026.5.12
  • ==2026.5.12

Matching in nixpkgs