Nixpkgs security tracker

Permalink CVE-2025-58933

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored package anubis 6 months, 2 weeks ago
@LeSuisse dismissed 6 months, 2 weeks ago

WordPress Anubis theme <= 1.25 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Anubis anubis allows PHP Local File Inclusion.This issue affects Anubis: from n/a through <= 1.25.

References

Affected products

anubis

=<<= 1.25

Ignored packages (1)

pkgs.anubis

Weighs the soul of incoming HTTP requests using proof-of-work to stop AI crawlers

nixos-unstable 1.23.1
- nixpkgs-unstable 1.23.1
- nixos-unstable-small 1.23.1

WP theme not present in nixpkgs

Permalink CVE-2025-58928

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored
2 packages
- heartbeat7
- anytype-heart
6 months, 2 weeks ago
@LeSuisse dismissed 6 months, 2 weeks ago

WordPress Heart theme <= 1.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Heart heart allows PHP Local File Inclusion.This issue affects Heart: from n/a through <= 1.8.

References

Affected products

heart

=<<= 1.8

Ignored packages (2)

pkgs.heartbeat7

Lightweight shipper for uptime monitoring

nixos-unstable 7.17.27
- nixpkgs-unstable 7.17.27
- nixos-unstable-small 7.17.27

pkgs.anytype-heart

Shared library for Anytype clients

nixos-unstable 0.44.5
- nixpkgs-unstable 0.44.5
- nixos-unstable-small 0.44.5

WP theme not present in nixpkgs

Permalink CVE-2025-66117

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored package ocamlPackages.easy-format 6 months, 2 weeks ago
@LeSuisse dismissed 6 months, 2 weeks ago

WordPress Easy Form plugin <= 2.7.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ays Pro Easy Form easy-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form: from n/a through <= 2.7.8.

References

Affected products

easy-form

=<<= 2.7.8

Ignored packages (1)

pkgs.ocamlPackages.easy-format

High-level and functional interface to the Format module of the OCaml standard library

nixos-unstable 1.3.4
- nixpkgs-unstable 1.3.4
- nixos-unstable-small 1.3.4

WP plugin not present in nixpkgs

Permalink CVE-2025-53445

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored package catppuccin-catwalk 6 months, 2 weeks ago
@LeSuisse dismissed 6 months, 2 weeks ago

WordPress Catwalk theme <= 1.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Catwalk catwalk allows PHP Local File Inclusion.This issue affects Catwalk: from n/a through <= 1.4.

References

Affected products

catwalk

=<<= 1.4

Ignored packages (1)

pkgs.catppuccin-catwalk

CLI for Catppuccin that takes in four showcase images and displays them all at once

nixos-unstable 1.3.2
- nixpkgs-unstable 1.3.2
- nixos-unstable-small 1.3.2

WP theme not present in nixpkgs

Permalink CVE-2025-67921

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored package colobot 6 months, 2 weeks ago
@LeSuisse dismissed 6 months, 2 weeks ago

WordPress Lobo theme < 2.8.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue affects Lobo: from n/a through < 2.8.6.

References

Affected products

lobo

=<< 2.8.6

Ignored packages (1)

pkgs.colobot

Real-time strategy game with programmable bots

nixos-unstable 0.2.2-alpha
- nixpkgs-unstable 0.2.2-alpha
- nixos-unstable-small 0.2.2-alpha

WP theme not present in nixpkgs

Permalink CVE-2025-14430

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored package brook 6 months, 2 weeks ago
@LeSuisse dismissed 6 months, 2 weeks ago

WordPress Brook - Agency Business Creative theme <= 2.8.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook - Agency Business Creative brook allows PHP Local File Inclusion.This issue affects Brook - Agency Business Creative: from n/a through <= 2.8.9.

References

Affected products

brook

=<<= 2.8.9

Ignored packages (1)

pkgs.brook

Cross-platform Proxy/VPN software

nixos-unstable 20240606
- nixpkgs-unstable 20240606
- nixos-unstable-small 20240606

WP theme not present in nixpkgs

Permalink CVE-2025-67928

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored package haskellPackages.automotive-cse 6 months, 2 weeks ago
@LeSuisse dismissed 6 months, 2 weeks ago

WordPress Automotive Listings plugin <= 18.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQL Injection.This issue affects Automotive Listings: from n/a through <= 18.6.

References

Affected products

automotive

=<<= 18.6

Ignored packages (1)

pkgs.haskellPackages.automotive-cse

Automotive CSE emulation

nixos-unstable 0.1.8.0
- nixpkgs-unstable 0.1.8.0
- nixos-unstable-small 0.1.8.0

WP plugin not present in nixpkgs

Permalink CVE-2025-22712

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored package cargo-typify 6 months, 2 weeks ago
@LeSuisse dismissed 6 months, 2 weeks ago

WordPress Typify theme <= 3.0.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Typify typify allows PHP Local File Inclusion.This issue affects Typify: from n/a through <= 3.0.2.

References

Affected products

typify

=<<= 3.0.2

Ignored packages (1)

pkgs.cargo-typify

JSON Schema to Rust type converter

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
- nixos-unstable-small 0.1.0

WP theme not present in nixpkgs

Permalink CVE-2025-62136

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 6 months, 2 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 2 weeks ago
@LeSuisse ignored package melos 6 months, 2 weeks ago
@LeSuisse dismissed 6 months, 2 weeks ago

WordPress Melos theme <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThinkUpThemes Melos allows Stored XSS.This issue affects Melos: from n/a through 1.6.0.

References

Affected products

melos

=<1.6.0

Ignored packages (1)

pkgs.melos

Tool for managing Dart projects with multiple packages

nixos-unstable 7.3.0
- nixpkgs-unstable 7.3.0
- nixos-unstable-small 7.3.0

WP theme not present in nixpkgs

Permalink CVE-2025-62229

7.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 7 months, 1 week ago by @leona-ya Activity log

Created suggestion 8 months, 1 week ago
@leona-ya ignored package tigervnc 7 months, 1 week ago
@leona-ya accepted 7 months, 1 week ago
@leona-ya dismissed 7 months, 1 week ago

Xorg: xmayland: use-after-free in xpresentnotify structure creation

A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.

References

https://access.redhat.com/security/cve/CVE-2025-62229 x_refsource_REDHATvdb-entry
RHBZ#2402649 issue-trackingx_refsource_REDHAT
RHSA-2025:19432 x_refsource_REDHATvendor-advisory
RHSA-2025:19433 x_refsource_REDHATvendor-advisory
RHSA-2025:19434 x_refsource_REDHATvendor-advisory
RHSA-2025:19435 x_refsource_REDHATvendor-advisory
RHSA-2025:19489 x_refsource_REDHATvendor-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00033.html
RHSA-2025:19623 x_refsource_REDHATvendor-advisory
http://www.openwall.com/lists/oss-security/2025/10/28/7
RHSA-2025:19909 x_refsource_REDHATvendor-advisory
RHSA-2025:20958 x_refsource_REDHATvendor-advisory
RHSA-2025:20960 x_refsource_REDHATvendor-advisory
RHSA-2025:20961 x_refsource_REDHATvendor-advisory
RHSA-2025:21035 x_refsource_REDHATvendor-advisory
RHSA-2025:22040 x_refsource_REDHATvendor-advisory
RHSA-2025:22041 x_refsource_REDHATvendor-advisory
RHSA-2025:22051 x_refsource_REDHATvendor-advisory
RHSA-2025:22055 x_refsource_REDHATvendor-advisory
RHSA-2025:22056 x_refsource_REDHATvendor-advisory
RHSA-2025:22077 x_refsource_REDHATvendor-advisory
RHSA-2025:22096 x_refsource_REDHATvendor-advisory
RHSA-2025:22164 x_refsource_REDHATvendor-advisory
RHSA-2025:22167 x_refsource_REDHATvendor-advisory
RHSA-2025:22364 x_refsource_REDHATvendor-advisory
RHSA-2025:22365 x_refsource_REDHATvendor-advisory
RHSA-2025:22426 x_refsource_REDHATvendor-advisory
RHSA-2025:22427 x_refsource_REDHATvendor-advisory
RHSA-2025:22667 x_refsource_REDHATvendor-advisory
RHSA-2025:22729 x_refsource_REDHATvendor-advisory
RHSA-2025:22742 x_refsource_REDHATvendor-advisory
RHSA-2025:22753 x_refsource_REDHATvendor-advisory
RHSA-2026:0031 x_refsource_REDHATvendor-advisory
RHSA-2026:0033 x_refsource_REDHATvendor-advisory
RHSA-2026:0034 x_refsource_REDHATvendor-advisory
RHSA-2026:0035 x_refsource_REDHATvendor-advisory
RHSA-2026:0036 x_refsource_REDHATvendor-advisory

Affected products

tigervnc

*

xwayland

<24.1.9

xorg-x11-server

*

xorg-x11-server-Xwayland

*

Ignored packages (1)

pkgs.tigervnc

Fork of tightVNC, made in cooperation with VirtualGL

nixos-unstable 1.15.0
- nixpkgs-unstable 1.15.0
- nixos-unstable-small 1.15.0

already updated in nixpkgs 25.05, 25.11 and unstable.

Dismissed suggestions

References

Affected products

pkgs.anubis

References

Affected products

pkgs.heartbeat7

pkgs.anytype-heart

References

Affected products

pkgs.ocamlPackages.easy-format

References

Affected products

pkgs.catppuccin-catwalk

References

Affected products

pkgs.colobot

References

Affected products

pkgs.brook

References

Affected products

pkgs.haskellPackages.automotive-cse

References

Affected products

pkgs.cargo-typify

References

Affected products

pkgs.melos

References

Affected products

pkgs.tigervnc