Nixpkgs security tracker

Try the new UI
Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2026-92248
7.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 1 day ago Activity log
  • Created suggestion 1 week, 1 day ago
Gimp: integer overflow when generating a thumbnail preview for a psd file

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.

Affected products

gimp
gimp:2.8/gimp

Matching in nixpkgs

pkgs.gimp

GNU Image Manipulation Program

  • nixos-unstable -
    • nixos-unstable-small 3.2.6
  • nixos-26.05 -
    • nixos-26.05-small 3.0.8

pkgs.gimp2

GNU Image Manipulation Program

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gimp3

GNU Image Manipulation Program

  • nixos-unstable -
    • nixos-unstable-small 3.2.6
  • nixos-26.05 -
    • nixos-26.05-small 3.0.8

pkgs.gimpPlugins.gimp

GNU Image Manipulation Program

  • nixos-unstable -
    • nixos-unstable-small 3.2.6
  • nixos-26.05 -
    • nixos-26.05-small 3.0.8

pkgs.gimpPlugins.gmic

GIMP plugin for the G'MIC image processing framework

  • nixos-unstable -
    • nixos-unstable-small 3.5.0
  • nixos-26.05 -
    • nixos-26.05-small 3.5.0

pkgs.gimp-with-plugins

GNU Image Manipulation Program with plugins

  • nixos-unstable -
    • nixos-unstable-small 3.2.6
  • nixos-26.05 -
    • nixos-26.05-small 3.0.8

pkgs.gimp2Plugins.bimp

Batch Image Manipulation Plugin for GIMP

  • nixos-unstable -
    • nixos-unstable-small 2.6
  • nixos-26.05 -
    • nixos-26.05-small 2.6

pkgs.gimp2Plugins.gmic

GIMP plugin for the G'MIC image processing framework

  • nixos-unstable -
    • nixos-unstable-small 3.5.0
  • nixos-26.05 -
    • nixos-26.05-small 3.5.0

pkgs.gimp3-with-plugins

GNU Image Manipulation Program with plugins

  • nixos-unstable -
    • nixos-unstable-small 3.2.6
  • nixos-26.05 -
    • nixos-26.05-small 3.0.8

pkgs.gimp2Plugins.fourier

GIMP plug-in to do the fourier transform

  • nixos-unstable -
    • nixos-unstable-small 0.4.3
  • nixos-26.05 -
    • nixos-26.05-small 0.4.3

Package maintainers

Permalink CVE-2026-91728
9.6 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 1 day ago Activity log
  • Created suggestion 1 week, 1 day ago
Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 …

Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected products

Chrome
  • <153.0.8010.47

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small

pkgs.mkchromecast

Cast macOS and Linux Audio/Video to your Google Cast and Sonos Devices

pkgs.chrome-export

Scripts to save Google Chrome's bookmarks and history as HTML bookmarks files

  • nixos-unstable -
    • nixos-unstable-small 2.0.2
  • nixos-26.05 -
    • nixos-26.05-small 2.0.2

pkgs.go-chromecast

CLI for Google Chromecast, Home devices and Cast Groups

  • nixos-unstable -
    • nixos-unstable-small 0.3.4
  • nixos-26.05 -
    • nixos-26.05-small 0.3.4

pkgs.xf86videoopenchrome

VIA Technologies UniChrome and Chrome9 IGP video driver for the Xorg X server

  • nixos-unstable -
  • nixos-26.05 -

pkgs.chrome-token-signing

Chrome and Firefox extension for signing with your eID on the web

  • nixos-unstable -
    • nixos-unstable-small 1.1.5
  • nixos-26.05 -
    • nixos-26.05-small 1.1.5

pkgs.electron-chromedriver

WebDriver server for running Selenium tests on Chrome

  • nixos-unstable -
  • nixos-26.05 -

pkgs.xf86-video-openchrome

VIA Technologies UniChrome and Chrome9 IGP video driver for the Xorg X server

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gnomeExtensions.monochrome-toggle

Quick Settings toggle for monochrome, desatured or sepia tinted display. Based on Achroma.

  • nixos-unstable -
    • nixos-unstable-small 1
Permalink CVE-2026-92048
created 1 week, 1 day ago Activity log
  • Created suggestion 1 week, 1 day ago
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.

Affected products

Firefox
  • =<153.*
  • =<*
Thunderbird
  • =<*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

  • nixos-unstable -
  • nixos-26.05 -

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivatives

  • nixos-unstable -
    • nixos-unstable-small 1.1.3
  • nixos-26.05 -
    • nixos-26.05-small 1.1.3

pkgs.thunderbird-cli

Low-level CLI to manage Mozilla Thunderbird email from the shell

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.thunderbird-mcp

MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars

  • nixos-unstable -
    • nixos-unstable-small 0.7.4
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -
    • nixos-26.05-small 156.0

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -
    • nixos-26.05-small 156.0

pkgs.firefox-gnome-theme

GNOME theme for Firefox

  • nixos-unstable -
    • nixos-unstable-small 150
  • nixos-26.05 -
    • nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-mcp

MCP server that gives full access to your email through Mozilla Thunderbird

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

  • nixos-unstable -
    • nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-bridge

HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.pkgsRocm.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

  • nixos-unstable -
    • nixos-unstable-small 7
  • nixos-26.05 -
    • nixos-26.05-small 7

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

  • nixos-unstable -
    • nixos-unstable-small 4
  • nixos-26.05 -
    • nixos-26.05-small 4

Package maintainers

Permalink CVE-2026-92041
created 1 week, 1 day ago Activity log
  • Created suggestion 1 week, 1 day ago
Mitigation bypass in the DOM: Networking component

Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.

Affected products

Firefox
  • =<153.*
  • =<*
Thunderbird
  • =<*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

  • nixos-unstable -
  • nixos-26.05 -

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivatives

  • nixos-unstable -
    • nixos-unstable-small 1.1.3
  • nixos-26.05 -
    • nixos-26.05-small 1.1.3

pkgs.thunderbird-cli

Low-level CLI to manage Mozilla Thunderbird email from the shell

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.thunderbird-mcp

MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars

  • nixos-unstable -
    • nixos-unstable-small 0.7.4
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -
    • nixos-26.05-small 156.0

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -
    • nixos-26.05-small 156.0

pkgs.firefox-gnome-theme

GNOME theme for Firefox

  • nixos-unstable -
    • nixos-unstable-small 150
  • nixos-26.05 -
    • nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-mcp

MCP server that gives full access to your email through Mozilla Thunderbird

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

  • nixos-unstable -
    • nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-bridge

HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.pkgsRocm.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

  • nixos-unstable -
    • nixos-unstable-small 7
  • nixos-26.05 -
    • nixos-26.05-small 7

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

  • nixos-unstable -
    • nixos-unstable-small 4
  • nixos-26.05 -
    • nixos-26.05-small 4

Package maintainers

Permalink CVE-2026-19781
7.8 HIGH
  • CVSS version (CVSS): 3.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 1 day ago Activity log
  • Created suggestion 1 week, 1 day ago
Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28173.

References

Affected products

Cobalt
  • ==1204.204

Matching in nixpkgs

pkgs.cobalt

Static site generator written in Rust

  • nixos-unstable -
  • nixos-26.05 -

Package maintainers

Permalink CVE-2026-92005
created 1 week, 1 day ago Activity log
  • Created suggestion 1 week, 1 day ago
Use-after-free in the Audio/Video: Web Codecs component

Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16.

Affected products

Firefox
  • =<153.*
  • =<140.*
  • =<*
Thunderbird
  • =<*
  • =<140.*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

  • nixos-unstable -
  • nixos-26.05 -

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivatives

  • nixos-unstable -
    • nixos-unstable-small 1.1.3
  • nixos-26.05 -
    • nixos-26.05-small 1.1.3

pkgs.thunderbird-cli

Low-level CLI to manage Mozilla Thunderbird email from the shell

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.thunderbird-mcp

MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars

  • nixos-unstable -
    • nixos-unstable-small 0.7.4
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -
    • nixos-26.05-small 156.0

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -
    • nixos-26.05-small 156.0

pkgs.firefox-gnome-theme

GNOME theme for Firefox

  • nixos-unstable -
    • nixos-unstable-small 150
  • nixos-26.05 -
    • nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-mcp

MCP server that gives full access to your email through Mozilla Thunderbird

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

  • nixos-unstable -
    • nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-bridge

HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.pkgsRocm.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

  • nixos-unstable -
    • nixos-unstable-small 7
  • nixos-26.05 -
    • nixos-26.05-small 7

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

  • nixos-unstable -
    • nixos-unstable-small 4
  • nixos-26.05 -
    • nixos-26.05-small 4

Package maintainers

Permalink CVE-2026-92044
created 1 week, 1 day ago Activity log
  • Created suggestion 1 week, 1 day ago
Information disclosure in the Networking: HTTP component

Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156.

Affected products

Firefox
  • =<*
  • =<153.*
Thunderbird
  • =<*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

  • nixos-unstable -
  • nixos-26.05 -

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivatives

  • nixos-unstable -
    • nixos-unstable-small 1.1.3
  • nixos-26.05 -
    • nixos-26.05-small 1.1.3

pkgs.thunderbird-cli

Low-level CLI to manage Mozilla Thunderbird email from the shell

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.thunderbird-mcp

MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars

  • nixos-unstable -
    • nixos-unstable-small 0.7.4
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -
    • nixos-26.05-small 156.0

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

  • nixos-unstable -
    • nixos-unstable-small 156.0
  • nixos-26.05 -
    • nixos-26.05-small 156.0

pkgs.firefox-gnome-theme

GNOME theme for Firefox

  • nixos-unstable -
    • nixos-unstable-small 150
  • nixos-26.05 -
    • nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-mcp

MCP server that gives full access to your email through Mozilla Thunderbird

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

  • nixos-unstable -
    • nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.thunderbird-cli-bridge

HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.

  • nixos-unstable -
    • nixos-unstable-small 1.1.0
  • nixos-26.05 -
    • nixos-26.05-small 1.0.2

pkgs.pkgsRocm.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

  • nixos-unstable -
    • nixos-unstable-small 7
  • nixos-26.05 -
    • nixos-26.05-small 7

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

  • nixos-unstable -
    • nixos-unstable-small 4
  • nixos-26.05 -
    • nixos-26.05-small 4

Package maintainers

Permalink CVE-2026-82837
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 1 week, 1 day ago Activity log
  • Created suggestion 1 week, 1 day ago
Insertion of Sensitive Information Into Sent Data in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to improper authorization checks on internal data emission endpoints.

Affected products

GitLab
  • <19.2.6
  • <19.3.2
  • <19.1.8

Matching in nixpkgs

pkgs.gitlab

GitLab Community Edition

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-ee

GitLab Enterprise Edition

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-art

Pull cross-project Gitlab artifact dependencies

  • nixos-unstable -
    • nixos-unstable-small 0.5.0
  • nixos-26.05 -
    • nixos-26.05-small 0.5.0

pkgs.gitlab-duo

CLI for GitLab AI assistant

  • nixos-unstable -
    • nixos-unstable-small 9.6.0
  • nixos-26.05 -

pkgs.gitlab-kas

Kubernetes Agent (Gitlab side)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-ci-ls

GitLab CI Language Server (gitlab-ci-ls)

  • nixos-unstable -
    • nixos-unstable-small 1.4.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.2

pkgs.gitlab-pages

Daemon used to serve static websites for GitLab users

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-shell

SSH access and repository management app for GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.danger-gitlab

Gem that exists to ensure all dependencies are set up for Danger with GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-clippy

Convert clippy warnings into GitLab Code Quality report

  • nixos-unstable -
    • nixos-unstable-small 1.0.3
  • nixos-26.05 -
    • nixos-26.05-small 1.0.3

pkgs.gitlab-runner

GitLab Runner the continuous integration executor of GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-triage

GitLab's issues and merge requests triage, automated

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-ci-local

Run gitlab pipelines locally as shell executor or docker executor

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gitlab-timelogs

CLI utility to support you with your time logs in GitLab

  • nixos-unstable -
    • nixos-unstable-small 0.7.1
  • nixos-26.05 -
    • nixos-26.05-small 0.7.1

pkgs.gitlab-ci-linter

.gitlab-ci.yml lint helper tool

  • nixos-unstable -
    • nixos-unstable-small 2.4.0
  • nixos-26.05 -
    • nixos-26.05-small 2.4.0

pkgs.gitlab-ci-validate

Command line tool to validate .gitlab-ci.yml files

  • nixos-unstable -
    • nixos-unstable-small 0.6.0

pkgs.gitlab-release-cli

Toolset to create, retrieve and update releases on GitLab

  • nixos-unstable -
  • nixos-26.05 -

pkgs.ocamlPackages.gitlab

Native OCaml bindings to Gitlab REST API v4

  • nixos-unstable -
    • nixos-unstable-small 0.1.8
  • nixos-26.05 -
    • nixos-26.05-small 0.1.8

Package maintainers

Permalink CVE-2026-48987
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
created 1 week, 1 day ago Activity log
  • Created suggestion 1 week, 1 day ago
pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends a Client object to the clients list for each unique uuid submitted to the authenticated getEvents API endpoint, but get_events does not invoke the available clean method to remove inactive clients. An authenticated user can repeatedly submit unique UUID values, causing retained client objects and process memory to grow without bound even after requests stop. The resulting memory exhaustion can trigger an operating-system out-of-memory termination of pyLoad or host-wide instability and denial of service. This issue is fixed in version 0.5.0b3.dev101.

Affected products

pyload
  • ==< 0.5.0b3.dev101

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-91962
5.3 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 1 week, 1 day ago Activity log
  • Created suggestion 1 week, 1 day ago
FreeRDP before 3.31.0 Integer Overflow via audin Apple backends

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer allocation and potential out-of-bounds access.

Affected products

FreeRDP
  • ==3.31.0
  • <3.31.0

Matching in nixpkgs

pkgs.freerdp

Remote Desktop Protocol Client

  • nixos-unstable -
  • nixos-26.05 -

Package maintainers