Nixpkgs security tracker

Login with GitHub

Dismissed suggestions

These automatic suggestions were dismissed after initial triaging.

to select a suggestion for revision.

View:
Compact
Detailed
Dismissed
(not in Nixpkgs)
Permalink CVE-2026-65550
5.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 5 days, 15 hours ago by @LeSuisse Activity log
  • Created suggestion 6 days, 6 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 5 days, 15 hours ago
WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.

Affected products

tabs-responsive
  • =<2.5

Matching in nixpkgs

pkgs.gnomeExtensions.application-tabs

Panel will include a different window tab for the same application that is currently launched.

  • nixos-unstable 43
    • nixpkgs-unstable 43
    • nixos-unstable-small 43
  • nixos-26.05 43
    • nixos-26.05-small 43
    • nixpkgs-26.05-darwin 43

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-15611
updated 5 days, 15 hours ago by @LeSuisse Activity log
  • Created suggestion 6 days, 6 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 5 days, 15 hours ago
Unverified email-based SSO account linking

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.

Affected products

Logto
  • =<1.37.1

Matching in nixpkgs

pkgs.logtop

Displays a real-time count of strings received from stdin

  • nixos-unstable 0.7
    • nixpkgs-unstable 0.7
    • nixos-unstable-small 0.7
  • nixos-26.05 0.7
    • nixos-26.05-small 0.7
    • nixpkgs-26.05-darwin 0.7

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-65906
8.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 days, 15 hours ago by @LeSuisse Activity log
  • Created suggestion 6 days, 6 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 5 days, 15 hours ago
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin …

In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible

Affected products

TeamCity
  • <2026.1.2, 2025.11.6

Matching in nixpkgs

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-15612
updated 5 days, 15 hours ago by @LeSuisse Activity log
  • Created suggestion 6 days, 6 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 5 days, 15 hours ago
LOIDC nonce validation bypass

Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.

Affected products

Logto
  • =<1.37.1

Matching in nixpkgs

pkgs.logtop

Displays a real-time count of strings received from stdin

  • nixos-unstable 0.7
    • nixpkgs-unstable 0.7
    • nixos-unstable-small 0.7
  • nixos-26.05 0.7
    • nixos-26.05-small 0.7
    • nixpkgs-26.05-darwin 0.7

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-15614
updated 5 days, 15 hours ago by @LeSuisse Activity log
  • Created suggestion 6 days, 6 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 5 days, 15 hours ago
IdP-initiated SAML sessions not reliably invalidated (replay)

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

Affected products

Logto
  • =<1.37.1

Matching in nixpkgs

pkgs.logtop

Displays a real-time count of strings received from stdin

  • nixos-unstable 0.7
    • nixpkgs-unstable 0.7
    • nixos-unstable-small 0.7
  • nixos-26.05 0.7
    • nixos-26.05-small 0.7
    • nixpkgs-26.05-darwin 0.7

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-61949
9.3 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 5 days, 15 hours ago by @LeSuisse Activity log
  • Created suggestion 6 days, 6 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 5 days, 15 hours ago
WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

Unauthenticated SQL Injection in Bookly <= 27.7 versions.

Affected products

bookly-responsive-appointment-booking-tool
  • =<27.7

Matching in nixpkgs

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-47755
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 5 days, 15 hours ago by @LeSuisse Activity log
  • Created suggestion 6 days, 6 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 5 days, 15 hours ago
ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal with an arbitrary `credential_id`. The endpoint does not enforce client scoping or object-level authorization before loading and decrypting the credential record. Version 26.05 fixes the issue.

Affected products

itflow
  • ==< 26.05

Matching in nixpkgs

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-61944
7.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 5 days, 15 hours ago by @LeSuisse Activity log
  • Created suggestion 6 days, 6 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 5 days, 15 hours ago
WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.

Affected products

bookly-responsive-appointment-booking-tool
  • =<27.7

Matching in nixpkgs

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-65907
9.1 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 days, 15 hours ago by @LeSuisse Activity log
  • Created suggestion 6 days, 6 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 5 days, 15 hours ago
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git …

In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible

Affected products

TeamCity
  • <2026.1.2, 2025.11.6

Matching in nixpkgs

Package maintainers

Dismissed
(no matching packages found)
Permalink CVE-2026-15015
9.8 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 6 days, 6 hours ago Activity log
  • Created & dismissed (no matching packages found) suggestion 6 days, 6 hours ago
MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full administrator-equivalent access to the plugin's MCP tool surface and all exposed WordPress content, users, and options. This is exploitable by combining the publicly accessible Dynamic Client Registration endpoint, which allows unauthenticated callers to register arbitrary OAuth clients with an attacker-controlled redirect_uri, with the unprotected authorization endpoint to complete the full OAuth flow without any administrator interaction.

Affected products

MountDev AI MCP Connector for WordPress
  • =<1.6.1