Nixpkgs Security Tracker

Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2026-2799
created 3 weeks, 4 days ago
Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

References

Affected products

Firefox
  • <148
Thunderbird
  • <148

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-2777
created 3 weeks, 4 days ago
Privilege escalation in the Messaging System component

Privilege escalation in the Messaging System component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

References

Affected products

Firefox
  • <148
Firefox ESR
  • <140.8
  • <115.33
Thunderbird
  • <140.8
  • <148

Matching in nixpkgs

Package maintainers

Permalink CVE-2022-1499
created 3 weeks, 4 days ago
Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 …

Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

References

Affected products

Chrome
  • <101.0.4951.41

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-25.11 -
    • nixos-25.11-small
    • nixpkgs-25.11-darwin
Permalink CVE-2022-1310
created 3 weeks, 4 days ago
Use after free in regular expressions in Google Chrome prior …

Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

References

Affected products

Chrome
  • <100.0.4896.88

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-25.11 -
    • nixos-25.11-small
    • nixpkgs-25.11-darwin
Permalink CVE-2022-1354
created 3 weeks, 4 days ago
A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c …

A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.

References

Affected products

libtiff
  • ==Not-Known

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-2791
created 3 weeks, 4 days ago
Mitigation bypass in the Networking: Cache component

Mitigation bypass in the Networking: Cache component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

References

Affected products

Firefox
  • <148
Firefox ESR
  • <140.8
Thunderbird
  • <140.8
  • <148

Matching in nixpkgs

Package maintainers

Permalink CVE-2022-1313
created 3 weeks, 4 days ago
Use after free in tab groups in Google Chrome prior …

Use after free in tab groups in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

References

Affected products

Chrome
  • <100.0.4896.88

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-25.11 -
    • nixos-25.11-small
    • nixpkgs-25.11-darwin
Permalink CVE-2026-2760
created 3 weeks, 4 days ago
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

References

Affected products

Firefox
  • <148
Firefox ESR
  • <140.8
  • <115.33
Thunderbird
  • <140.8
  • <148

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-2782
created 3 weeks, 4 days ago
Privilege escalation in the Netmonitor component

Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

References

Affected products

Firefox
  • <148
Firefox ESR
  • <140.8
Thunderbird
  • <140.8
  • <148

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-2762
created 3 weeks, 4 days ago
Integer overflow in the JavaScript: Standard Library component

Integer overflow in the JavaScript: Standard Library component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

References

Affected products

Firefox
  • <148
Firefox ESR
  • <140.8
Thunderbird
  • <140.8
  • <148

Matching in nixpkgs

Package maintainers