Nixpkgs Security Tracker

Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2026-2766
created 3 weeks, 4 days ago
Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

References

Affected products

Firefox
  • <148
Firefox ESR
  • <140.8
Thunderbird
  • <140.8
  • <148

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-2779
created 3 weeks, 4 days ago
Incorrect boundary conditions in the Networking: JAR component

Incorrect boundary conditions in the Networking: JAR component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

References

Affected products

Firefox
  • <148
Firefox ESR
  • <140.8
Thunderbird
  • <140.8
  • <148

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-2802
4.2 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 3 weeks, 4 days ago
Race condition in the JavaScript: GC component

Race condition in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

References

Affected products

Firefox
  • <148
Thunderbird
  • <148

Matching in nixpkgs

Package maintainers

Permalink CVE-2022-1484
created 3 weeks, 4 days ago
Heap buffer overflow in Web UI Settings in Google Chrome …

Heap buffer overflow in Web UI Settings in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

References

Affected products

Chrome
  • <101.0.4951.41

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-25.11 -
    • nixos-25.11-small
    • nixpkgs-25.11-darwin
Permalink CVE-2026-2772
created 3 weeks, 4 days ago
Use-after-free in the Audio/Video: Playback component

Use-after-free in the Audio/Video: Playback component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

References

Affected products

Firefox
  • <148
Firefox ESR
  • <140.8
  • <115.33
Thunderbird
  • <140.8
  • <148

Matching in nixpkgs

Package maintainers

Permalink CVE-2022-1500
created 3 weeks, 4 days ago
Insufficient data validation in Dev Tools in Google Chrome prior …

Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy via a crafted HTML page.

References

Affected products

Chrome
  • <101.0.4951.41

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-25.11 -
    • nixos-25.11-small
    • nixpkgs-25.11-darwin
Permalink CVE-2022-1492
created 3 weeks, 4 days ago
Insufficient data validation in Blink Editing in Google Chrome prior …

Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page.

References

Affected products

Chrome
  • <101.0.4951.41

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-25.11 -
    • nixos-25.11-small
    • nixpkgs-25.11-darwin
Permalink CVE-2026-2805
created 3 weeks, 4 days ago
Invalid pointer in the DOM: Core & HTML component

Invalid pointer in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

References

Affected products

Firefox
  • <148
Thunderbird
  • <148

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-2785
created 3 weeks, 4 days ago
Invalid pointer in the JavaScript Engine component

Invalid pointer in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

References

Affected products

Firefox
  • <148
Firefox ESR
  • <140.8
Thunderbird
  • <140.8
  • <148

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-2776
created 3 weeks, 4 days ago
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

References

Affected products

Firefox
  • <148
Firefox ESR
  • <140.8
  • <115.33
Thunderbird
  • <140.8
  • <148

Matching in nixpkgs

Package maintainers