Nixpkgs security tracker

Untriaged

Permalink CVE-2026-49370

3.4 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 3 weeks, 6 days ago Activity log

Created suggestion 3 weeks, 6 days ago

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on …

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

YouTrack

<2026.1.13162

Matching in nixpkgs

pkgs.youtrack

Issue tracking and project management tool for developers

nixos-unstable 2026.1.12458
- nixpkgs-unstable 2026.1.12458
- nixos-unstable-small 2026.1.12458

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>

Untriaged

Permalink CVE-2026-49368

8.7 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 3 weeks, 6 days ago Activity log

Created suggestion 3 weeks, 6 days ago

In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification …

In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

YouTrack

<2026.1.13162

Matching in nixpkgs

pkgs.youtrack

Issue tracking and project management tool for developers

nixos-unstable 2026.1.12458
- nixpkgs-unstable 2026.1.12458
- nixos-unstable-small 2026.1.12458

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>

Untriaged

Permalink CVE-2026-49369

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 3 weeks, 6 days ago Activity log

Created suggestion 3 weeks, 6 days ago

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on …

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

YouTrack

<2026.1.13162

Matching in nixpkgs

pkgs.youtrack

Issue tracking and project management tool for developers

nixos-unstable 2026.1.12458
- nixpkgs-unstable 2026.1.12458
- nixos-unstable-small 2026.1.12458

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>

Untriaged

Permalink CVE-2026-49386

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 3 weeks, 6 days ago Activity log

Created suggestion 3 weeks, 6 days ago

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration …

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

YouTrack

<2026.1.13570

Matching in nixpkgs

pkgs.youtrack

Issue tracking and project management tool for developers

nixos-unstable 2026.1.12458
- nixpkgs-unstable 2026.1.12458
- nixos-unstable-small 2026.1.12458

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>

Untriaged

Permalink CVE-2026-49385

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 3 weeks, 6 days ago Activity log

Created suggestion 3 weeks, 6 days ago

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged …

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

YouTrack

<2026.1.13570

Matching in nixpkgs

pkgs.youtrack

Issue tracking and project management tool for developers

nixos-unstable 2026.1.12458
- nixpkgs-unstable 2026.1.12458
- nixos-unstable-small 2026.1.12458

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>

Published

Permalink CVE-2026-33392

7.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 2 months, 1 week ago by @LeSuisse Activity log

Created suggestion 2 months, 1 week ago
@LeSuisse accepted 2 months, 1 week ago
@LeSuisse published on GitHub 2 months, 1 week ago

In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve …

In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

YouTrack

<2025.3.131383

Matching in nixpkgs

pkgs.youtrack

Issue tracking and project management tool for developers

nixos-unstable 2025.3.121962
- nixpkgs-unstable 2025.3.121962
- nixos-unstable-small 2025.3.121962

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>

Published

Permalink CVE-2026-28193

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 3 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 3 months, 4 weeks ago
@LeSuisse accepted 3 months, 4 weeks ago
@LeSuisse published on GitHub 3 months, 4 weeks ago

In JetBrains YouTrack before 2025.3.121962 apps were able to send …

In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

YouTrack

<2025.3.121962

Matching in nixpkgs

pkgs.youtrack

Issue tracking and project management tool for developers

nixos-unstable 2025.3.121962
- nixpkgs-unstable 2025.3.121962
- nixos-unstable-small 2025.3.121962

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>

Published

Permalink CVE-2026-25846

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 4 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 4 months, 2 weeks ago
@LeSuisse accepted 4 months, 2 weeks ago
@LeSuisse published on GitHub 4 months, 2 weeks ago

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed …

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

YouTrack

<2025.3.119033

Matching in nixpkgs

pkgs.youtrack

Issue tracking and project management tool for developers

nixos-unstable 2025.1.86199
- nixpkgs-unstable 2025.1.86199
- nixos-unstable-small 2025.1.86199

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.youtrack

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.youtrack

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.youtrack

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.youtrack

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.youtrack

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.youtrack

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.youtrack

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.youtrack

Package maintainers