Nixpkgs security tracker

Dismissed

(no matching packages found)

Permalink CVE-2026-14504

8.2 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 week, 2 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 2 days ago

Nexus Repository 3 - Authorization Bypass in Component Upload API

An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.

References

Affected products

Nexus Repository 3

<3.94.0

Dismissed

(no matching packages found)

Permalink CVE-2026-49790

7.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 week, 2 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 2 days ago

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

References

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26226

Windows Server 2016

<10.0.14393.9339

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows Server 2012 R2

<6.3.9600.23291

Windows 10 Version 1607

<10.0.14393.9339

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26200.8875

Windows 11 version 26H1

<10.0.28000.2525

Windows Server 2012 (Server Core installation)

<6.2.9200.26226

Windows Server 2016 (Server Core installation)

<10.0.14393.9339

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23291

Dismissed

(no matching packages found)

Permalink CVE-2026-50425

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 week, 2 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 2 days ago

Windows Internal System User Profile Elevation of Privilege Vulnerability

Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally.

References

Windows Internal System User Profile Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Windows Server 2025

<10.0.26100.33158

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26200.8875

Windows 11 version 26H1

<10.0.28000.2269

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Dismissed

(no matching packages found)

Permalink CVE-2026-50482

7.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 week, 2 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 2 days ago

Windows NTFS Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

References

Windows NTFS Remote Code Execution Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26226

Windows Server 2016

<10.0.14393.9339

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows Server 2012 R2

<6.3.9600.23291

Windows 10 Version 1607

<10.0.14393.9339

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26200.8875

Windows 11 version 26H1

<10.0.28000.2269

Windows Server 2012 (Server Core installation)

<6.2.9200.26226

Windows Server 2016 (Server Core installation)

<10.0.14393.9339

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23291

Dismissed

(no matching packages found)

Permalink CVE-2026-47282

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 week, 2 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 2 days ago

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

References

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability patchvendor-advisory

Affected products

Visual Studio Code

<1.128.1

Dismissed

(no matching packages found)

Permalink CVE-2026-55027

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 week, 2 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 2 days ago

Microsoft Office Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

References

Microsoft Office Information Disclosure Vulnerability patchvendor-advisory

Affected products

Microsoft Office 2016

<16.0.5561.1000

Microsoft Office 2019

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2021

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2024

<https://aka.ms/OfficeSecurityReleases

Microsoft Office 365 for Mac

<16.111.26071215

Microsoft SharePoint Server 2019

<16.0.10417.20175

Microsoft 365 Apps for Enterprise

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC for Mac 2021

<16.111.26071215

Microsoft Office LTSC for Mac 2024

<16.111.26071215

Microsoft SharePoint Enterprise Server 2016

<16.0.5561.1001

Microsoft SharePoint Server Subscription Edition

<16.0.19725.20434

Dismissed

(no matching packages found)

Permalink CVE-2026-48322

9.6 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 1 week, 2 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 2 days ago

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

References

https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html vendor-advisory

Affected products

ColdFusion 2023

=<21
==22

ColdFusion 2025

==11
=<10

Dismissed

(no matching packages found)

Permalink CVE-2026-48069

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 1 week, 2 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 2 days ago

@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

References

https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq x_refsource_CONFIRM
https://github.com/grpc/grpc-node/commit/2375eadcc52ca2b1ef55288bcd6355168b02706c x_refsource_MISC
https://github.com/grpc/grpc-node/commit/2fe55fd76a8bb59eaab5f39e3552b5f84985a163 x_refsource_MISC
https://github.com/grpc/grpc-node/commit/4091bd902105f8fb655741758aee71418c48b5d5 x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b3f16094473b5c8f38b0955eafa4a19507127346 x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b61c4d65953db85c2ae55b4b3cd98a4259dc87cb x_refsource_MISC
https://github.com/grpc/grpc-node/commit/b6dcfc3cee9ef390e5869ebea5a8c5ae187720b9 x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.10.12 x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.11.4 x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.12.7 x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.13.5 x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.14.4 x_refsource_MISC
https://github.com/grpc/grpc-node/releases/tag/%40grpc%2Fgrpc-js%401.9.16 x_refsource_MISC

Affected products

grpc-node

==>= 1.11.0, < 1.11.4
==>= 1.14.0, < 1.14.4
==< 1.9.16
==>= 1.12.0, < 1.12.7
==>= 1.10.0, < 1.10.12
==>= 1.13.0, < 1.13.5

Dismissed

(no matching packages found)

Permalink CVE-2026-50504

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 week, 2 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 2 days ago

Windows Remote Desktop Client Information Disclosure Vulnerability

Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

References

Windows Remote Desktop Client Information Disclosure Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26226

Windows Server 2016

<10.0.14393.9339

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows Server 2012 R2

<6.3.9600.23291

Windows 10 Version 1607

<10.0.14393.9339

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26200.8875

Windows 11 version 26H1

<10.0.28000.2269

Windows Server 2012 (Server Core installation)

<6.2.9200.26226

Windows Server 2016 (Server Core installation)

<10.0.14393.9339

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23291

Dismissed

(no matching packages found)

Permalink CVE-2026-34346

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 week, 2 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 2 days ago

Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability

Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.

References

Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26226

Windows Server 2016

<10.0.14393.9339

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows Server 2012 R2

<6.3.9600.23291

Windows 10 Version 1607

<10.0.14393.9339

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 23H2

<10.0.22631.7376

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26200.8875

Windows 11 version 23H2

<10.0.22631.7376

Windows 11 version 26H1

<10.0.28000.2269

Windows Server 2012 (Server Core installation)

<6.2.9200.26226

Windows Server 2016 (Server Core installation)

<10.0.14393.9339

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23291

Dismissed suggestions

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products