Nixpkgs security tracker

Login with GitHub

Dismissed suggestions

These automatic suggestions were dismissed after initial triaging.

to select a suggestion for revision.

View:
Compact
Detailed
Dismissed
(not in Nixpkgs)
Permalink CVE-2026-65476
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 2 days, 20 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 2 days, 20 hours ago
WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

Affected products

Civi
  • =<2.2.4

Matching in nixpkgs

pkgs.civicrm

Standalone version of CiviCRM, a CRM software for non-profit organizations

  • nixos-unstable -

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-65479
5.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 2 days, 20 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 2 days, 20 hours ago
WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

Affected products

Reviewer
  • =<3.14.2

Matching in nixpkgs

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-16723
9.0 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 2 days, 20 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 2 days, 20 hours ago
Remote Code Execution in fastjson 1.2.68–1.2.83

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Affected products

Fastjson
  • =<1.2.83

Matching in nixpkgs

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-65526
8.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 2 days, 20 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 2 days, 20 hours ago
WordPress Visualizer plugin <= 4.0.6 - SQL Injection vulnerability

Contributor SQL Injection in Visualizer <= 4.0.6 versions.

Affected products

visualizer
  • =<4.0.6

Matching in nixpkgs

pkgs.midivisualizer

Small MIDI visualizer tool, using OpenGL

  • nixos-unstable 7.3
    • nixpkgs-unstable 7.3
    • nixos-unstable-small 7.3
  • nixos-26.05 7.3
    • nixos-26.05-small 7.3
    • nixpkgs-26.05-darwin 7.3

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-16767
5.5 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
updated 2 days, 20 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 2 days, 20 hours ago
Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

php-zip
  • ==4.0.2
  • ==4.0.1
  • ==4.0.0

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-57626
7.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 2 days, 20 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse dismissed 2 days, 20 hours ago
WordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0.

Affected products

mailpoet
  • =<5.33.0

Matching in nixpkgs

The version in nixpkgs is not in the impacted range
Dismissed
(not in Nixpkgs)
Permalink CVE-2026-15617
updated 2 days, 20 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 2 days, 20 hours ago
Principal/domain lookup without case normalization

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.

Affected products

Logto
  • =<1.37.1

Matching in nixpkgs

pkgs.logtop

Displays a real-time count of strings received from stdin

  • nixos-unstable 0.7
    • nixpkgs-unstable 0.7
    • nixos-unstable-small 0.7
  • nixos-26.05 0.7
    • nixos-26.05-small 0.7
    • nixpkgs-26.05-darwin 0.7

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-65481
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 2 days, 20 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 2 days, 20 hours ago
WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Vino <= 1.9 versions.

Affected products

Vino
  • =<1.9

Matching in nixpkgs

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-15616
updated 2 days, 20 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 2 days, 20 hours ago
Local MFA not enforced during SSO sign-in

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

Affected products

Logto
  • =<1.37.1

Matching in nixpkgs

pkgs.logtop

Displays a real-time count of strings received from stdin

  • nixos-unstable 0.7
    • nixpkgs-unstable 0.7
    • nixos-unstable-small 0.7
  • nixos-26.05 0.7
    • nixos-26.05-small 0.7
    • nixpkgs-26.05-darwin 0.7

Package maintainers

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-65464
5.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 2 days, 20 hours ago by @LeSuisse Activity log
  • Created suggestion 3 days, 11 hours ago
  • @LeSuisse dismissed (not in Nixpkgs) 2 days, 20 hours ago
WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

Affected products

give
  • =<4.16.3

Matching in nixpkgs