Nixpkgs security tracker

Untriaged

Permalink CVE-2026-5849

7.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Not Defined (X)
Report Confidence (RC): Reasonable (R)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 1 month, 2 weeks ago Activity log

Created suggestion 1 month, 2 weeks ago

Tenda i12 HTTP path traversal

A vulnerability was determined in Tenda i12 1.0.0.11(3862). The impacted element is an unknown function of the component HTTP Handler. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

References

VDB-356375 | Tenda i12 HTTP path traversal vdb-entry
VDB-356375 | CTI Indicators (IOB, IOC, TTP) signaturepermissions-required
Submit #791217 | Tenda i12 V1.0.0.11(3862) Path Traversal third-party-advisory
https://github.com/Litengzheng/vuldb_new/blob/main/i12/vul_110/README.md exploit
https://www.tenda.com.cn/ product

Affected products

i12

==1.0.0.11(3862)

Matching in nixpkgs

pkgs.xf86videoi128

Number Nine I128 video driver for the Xorg X server

nixos-unstable i128-1.4.1
- nixpkgs-unstable i128-1.4.1
- nixos-unstable-small i128-1.4.1

pkgs.xf86-video-i128

Number Nine I128 video driver for the Xorg X server

nixos-unstable i128-1.4.1
- nixpkgs-unstable i128-1.4.1
- nixos-unstable-small i128-1.4.1

pkgs.vscode-extensions.tomoki1207.pdf

Show PDF preview in VSCode

nixos-unstable tomoki1207-pdf-1.2.2
- nixpkgs-unstable tomoki1207-pdf-1.2.2
- nixos-unstable-small tomoki1207-pdf-1.2.2
nixos-25.11 tomoki1207-pdf-1.2.2
- nixos-25.11-small tomoki1207-pdf-1.2.2
- nixpkgs-25.11-darwin tomoki1207-pdf-1.2.2

Untriaged

Permalink CVE-2026-5609

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Not Defined (X)
Report Confidence (RC): Reasonable (R)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month, 2 weeks ago Activity log

Created suggestion 1 month, 2 weeks ago

Tenda i12 Parameter wifiSSIDset formwrlSSIDset stack-based overflow

A flaw has been found in Tenda i12 1.0.0.11(3862). Affected by this vulnerability is the function formwrlSSIDset of the file /goform/wifiSSIDset of the component Parameter Handler. This manipulation of the argument index/wl_radio causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.