Nixpkgs security tracker

Login with GitHub

Dismissed suggestions

These automatic suggestions were dismissed after initial triaging.

to select a suggestion for revision.

View:
Compact
Detailed
Permalink CVE-2025-15289
3.1 LOW
  • CVSS version: 3.1
  • Attack vector (AV):
  • Attack complexity (AC):
  • Privileges required (PR):
  • User interaction (UI):
  • Scope (S):
  • Confidentiality impact (C):
  • Integrity impact (I):
  • Availability impact (A):
updated 2 months, 3 weeks ago by @jopejoe1 Activity log
  • Created suggestion 2 months, 3 weeks ago
  • @jopejoe1 ignored
    20 packages
    • bash
    • interactsh
    • bashInteractive
    • gawkInteractive
    • coqPackages.ITree
    • bashInteractiveFHS
    • sqlite-interactive
    • texinfoInteractive
    • interactive-html-bom
    • kotlin-interactive-shell
    • perlPackages.IOInteractive
    • git-interactive-rebase-tool
    • perl538Packages.IOInteractive
    • perl540Packages.IOInteractive
    • perlPackages.IOInteractiveTiny
    • azure-cli-extensions.interactive
    • perl538Packages.IOInteractiveTiny
    • perl540Packages.IOInteractiveTiny
    • ocamlPackages.janeStreet.async_interactive
    • ocamlPackages_latest.janeStreet.async_interactive
    2 months, 3 weeks ago
  • @jopejoe1 dismissed 2 months, 3 weeks ago
Tanium addressed an improper access controls vulnerability in Interact.

Tanium addressed an improper access controls vulnerability in Interact.

References

Affected products

Interact
  • <3.5.90
  • <3.1.337
  • <3.2.185
Ignored packages (20)

pkgs.bash

GNU Bourne-Again Shell, the de facto standard shell on Linux (for interactive use)

pkgs.interactsh

Out of bounds interaction gathering server and client library

pkgs.bashInteractive

GNU Bourne-Again Shell, the de facto standard shell on Linux (for interactive use)

pkgs.bashInteractiveFHS

GNU Bourne-Again Shell, the de facto standard shell on Linux (for interactive use)

Not present in nixpkgs
Permalink CVE-2025-15324
6.6 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV):
  • Attack complexity (AC):
  • Privileges required (PR):
  • User interaction (UI):
  • Scope (S):
  • Confidentiality impact (C):
  • Integrity impact (I):
  • Availability impact (A):
updated 2 months, 3 weeks ago by @jopejoe1 Activity log
  • Created suggestion 2 months, 3 weeks ago
  • @jopejoe1 ignored package engage 2 months, 3 weeks ago
  • @jopejoe1 dismissed 2 months, 3 weeks ago
Tanium addressed a local privilege escalation vulnerability in Engage.

Tanium addressed a documentation issue in Engage.

References

Affected products

Engage
  • <1.3.37
  • <1.6.193
Ignored packages (1)

pkgs.engage

Task runner with DAG-based parallelism

Not present in nixpkgs
Permalink CVE-2020-37140
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
updated 2 months, 3 weeks ago by @jopejoe1 Activity log
  • Created suggestion 2 months, 3 weeks ago
  • @jopejoe1 ignored
    4 packages
    • everest
    • neverest
    • everest-bin
    • everest-mons
    2 months, 3 weeks ago
  • @jopejoe1 dismissed 2 months, 3 weeks ago
Everest 5.50.2100 - 'Open File' Denial of Service

Everest, later referred to as AIDA64, 5.50.2100 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating file open functionality. Attackers can generate a 450-byte buffer of repeated characters and paste it into the file open dialog to trigger an application crash.

Affected products

Everest
  • ==5.50.2100
Ignored packages (4)

pkgs.everest

Celeste mod loader (don't install; use celestegame instead)

  • nixos-unstable 6157
    • nixpkgs-unstable 6157
    • nixos-unstable-small 6157
  • nixos-25.11 5986
    • nixos-25.11-small 5986
    • nixpkgs-25.11-darwin 5986

pkgs.everest-bin

Celeste mod loader (don't install; use celestegame instead)

  • nixos-unstable 6157
    • nixpkgs-unstable 6157
    • nixos-unstable-small 6157
  • nixos-25.11 5986
    • nixos-25.11-small 5986
    • nixpkgs-25.11-darwin 5986

pkgs.everest-mons

A commandline Everest installer and mod manager for Celeste

Not present in nixpkgs also known as AIDA64
Permalink CVE-2025-15341
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV):
  • Attack complexity (AC):
  • Privileges required (PR):
  • User interaction (UI):
  • Scope (S):
  • Confidentiality impact (C):
  • Integrity impact (I):
  • Availability impact (A):
updated 2 months, 3 weeks ago by @jopejoe1 Activity log
  • Created suggestion 2 months, 3 weeks ago
  • @jopejoe1 ignored
    17 packages
    • gbenchmark
    • mqtt-benchmark
    • memtier-benchmark
    • rubyPackages.benchmark
    • ocamlPackages.benchmark
    • rubyPackages_3_1.benchmark
    • rubyPackages_3_2.benchmark
    • rubyPackages_3_3.benchmark
    • rubyPackages_3_4.benchmark
    • rubyPackages_4_0.benchmark
    • ocamlPackages_latest.benchmark
    • haskellPackages.benchmark-function
    • python312Packages.pytest-benchmark
    • python313Packages.pytest-benchmark
    • python314Packages.pytest-benchmark
    • haskellPackages.hashtable-benchmark
    • chickenPackages_5.chickenEggs.micro-benchmark
    2 months, 3 weeks ago
  • @jopejoe1 dismissed 2 months, 3 weeks ago
Tanium addressed an incorrect default permissions vulnerability in Benchmark.

Tanium addressed an incorrect default permissions vulnerability in Benchmark.

References

Affected products

Benchmark
  • <2.12.82
  • <2.9.188
  • <2.7.98
Ignored packages (17) 
Not present in nixpkgs
Permalink CVE-2025-15343
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV):
  • Attack complexity (AC):
  • Privileges required (PR):
  • User interaction (UI):
  • Scope (S):
  • Confidentiality impact (C):
  • Integrity impact (I):
  • Availability impact (A):
updated 2 months, 3 weeks ago by @jopejoe1 Activity log
  • Created suggestion 2 months, 3 weeks ago
  • @jopejoe1 ignored
    5 packages
    • haskellPackages.wai-enforce-https
    • python312Packages.lm-format-enforcer
    • python313Packages.lm-format-enforcer
    • python314Packages.lm-format-enforcer
    • vimPlugins.nvim-treesitter-parsers.enforce
    2 months, 3 weeks ago
  • @jopejoe1 dismissed 2 months, 3 weeks ago
Tanium addressed an incorrect default permissions vulnerability in Enforce.

Tanium addressed an incorrect default permissions vulnerability in Enforce.

References

Affected products

Enforce
  • <2.9.574
  • <2.8.601
  • <2.7.367
Ignored packages (5) 
Not present in nixpkgs
Permalink CVE-2025-15336
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV):
  • Attack complexity (AC):
  • Privileges required (PR):
  • User interaction (UI):
  • Scope (S):
  • Confidentiality impact (C):
  • Integrity impact (I):
  • Availability impact (A):
updated 2 months, 3 weeks ago by @jopejoe1 Activity log
  • Created suggestion 2 months, 3 weeks ago
  • @jopejoe1 ignored
    15 packages
    • portfolio
    • passmark-performancetest
    • rubyPackages.rubocop-performance
    • rubyPackages.standard-performance
    • libretro.bsnes-mercury-performance
    • rubyPackages_3_1.rubocop-performance
    • rubyPackages_3_2.rubocop-performance
    • rubyPackages_3_3.rubocop-performance
    • rubyPackages_3_4.rubocop-performance
    • rubyPackages_4_0.rubocop-performance
    • rubyPackages_3_1.standard-performance
    • rubyPackages_3_2.standard-performance
    • rubyPackages_3_3.standard-performance
    • rubyPackages_3_4.standard-performance
    • rubyPackages_4_0.standard-performance
    2 months, 3 weeks ago
  • @jopejoe1 dismissed 2 months, 3 weeks ago
Tanium addressed an incorrect default permissions vulnerability in Performance.

Tanium addressed an incorrect default permissions vulnerability in Performance.

References

Affected products

Performance
  • <1.21.141
  • <1.22.288
  • <1.17.134
Ignored packages (15)

pkgs.portfolio

Simple tool to calculate the overall performance of an investment portfolio

Not present in nixpkgs
Permalink CVE-2025-15340
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV):
  • Attack complexity (AC):
  • Privileges required (PR):
  • User interaction (UI):
  • Scope (S):
  • Confidentiality impact (C):
  • Integrity impact (I):
  • Availability impact (A):
updated 2 months, 3 weeks ago by @jopejoe1 Activity log
  • Created suggestion 2 months, 3 weeks ago
  • @jopejoe1 ignored
    3 packages
    • python314Packages.complycube
    • python313Packages.complycube
    • python312Packages.complycube
    2 months, 3 weeks ago
  • @jopejoe1 dismissed 2 months, 3 weeks ago
Tanium addressed an incorrect default permissions vulnerability in Comply.

Tanium addressed an incorrect default permissions vulnerability in Comply.

References

Affected products

Comply
  • <2.32.155
  • <2.29.124
  • <2.24.159
Ignored packages (3) 
Not present in nixpkgs
Permalink CVE-2024-56156
updated 2 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 2 months, 3 weeks ago
  • @LeSuisse ignored
    14 packages
    • eschalot
    • python312Packages.halo
    • python313Packages.halo
    • python314Packages.halo
    • typstPackages.whalogen
    • python312Packages.halohome
    • python313Packages.halohome
    • python314Packages.halohome
    • typstPackages.whalogen_0_1_0
    • typstPackages.whalogen_0_2_0
    • typstPackages.whalogen_0_3_0
    • python312Packages.django-cachalot
    • python313Packages.django-cachalot
    • python314Packages.django-cachalot
    2 months, 3 weeks ago
  • @LeSuisse dismissed 2 months, 3 weeks ago
Halo Vulnerable to Stored XSS and RCE via File Upload Bypass

Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13.

Affected products

halo
  • ==< 2.20.13

Matching in nixpkgs

Ignored packages (14)

Package maintainers

Current stable branch was never impacted.

https://github.com/NixOS/nixpkgs/pull/370594
https://github.com/NixOS/nixpkgs/pull/371151
Permalink CVE-2026-25815
3.2 LOW
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 2 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 2 months, 3 weeks ago
  • @LeSuisse ignored
    4 packages
    • terraform-providers.fortios
    • python312Packages.fortiosapi
    • python313Packages.fortiosapi
    • python314Packages.fortiosapi
    2 months, 3 weeks ago
  • @LeSuisse dismissed 2 months, 3 weeks ago
Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials …

Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by default, the encryption key is the same across all customers' installations). NOTE: the Supplier's position is that the instance of CWE-1394 is not a vulnerability because customers "are supposed to enable" a non-default option that eliminates the weakness. However, that non-default option can disrupt functionality as shown in the "Managing FortiGates with private data encryption" document, and is therefore intentionally not a default option.

Affected products

FortiOS
  • =<7.6.6
Ignored packages (4) 
Not present in nixpkgs
Permalink CVE-2022-50931
8.4 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 2 months, 3 weeks ago by @Scrumplex Activity log
  • Created suggestion 2 months, 3 weeks ago
  • @Scrumplex dismissed 2 months, 3 weeks ago
TeamSpeak 3.5.6 - Insecure File Permissions

TeamSpeak 3.5.6 contains an insecure file permissions vulnerability that allows local attackers to replace executable files with malicious binaries. Attackers can replace system executables like ts3client_win32.exe with custom files to potentially gain SYSTEM or Administrator-level access.

Affected products

TeamSpeak
  • ==3.5.6

Matching in nixpkgs

pkgs.teamspeak3

TeamSpeak voice communication tool

  • nixos-unstable 3.6.2
    • nixpkgs-unstable 3.6.2
    • nixos-unstable-small 3.6.2
  • nixos-25.11 -
    • nixos-25.11-small 3.6.2
    • nixpkgs-25.11-darwin 3.6.2

Package maintainers

All channels are patched.