Nixpkgs Security Tracker

Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
created 1 month ago
Incorrect security UI in interstitials in Google Chrome prior to …

Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

References

Affected products

Chrome
  • <79.0.3945.79

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-25.11 -
    • nixos-25.11-small
    • nixpkgs-25.11-darwin
created 1 month ago
Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 …

Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

References

Affected products

Chrome
  • <79.0.3945.79

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-25.11 -
    • nixos-25.11-small
    • nixpkgs-25.11-darwin
created 1 month ago
Insufficient policy enforcement in downloads in Google Chrome on Windows …

Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code.

References

Affected products

Chrome
  • <79.0.3945.79

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-25.11 -
    • nixos-25.11-small
    • nixpkgs-25.11-darwin
created 1 month ago
Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 …

Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected products

Chrome
  • <79.0.3945.79

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixpkgs-unstable
    • nixos-unstable-small
  • nixos-25.11 -
    • nixos-25.11-small
    • nixpkgs-25.11-darwin
created 1 month ago
WordPress Konte theme <= 2.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in uixthemes Konte konte allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Konte: from n/a through <= 2.4.6.

Affected products

konte
  • =<<= 2.4.6

Matching in nixpkgs

Package maintainers

Permalink CVE-2026-2681
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
updated 1 month ago by @LeSuisse Activity log
  • Created automatic suggestion
  • @LeSuisse removed package haskellPackages.hsblst
Github.com/supranational/blst: blst cryptographic library: denial of service via out-of-bounds stack write in key generation

A flaw was found in the blst cryptographic library. This out-of-bounds stack write vulnerability, specifically in the blst_sha256_bcopy assembly routine, occurs due to a missing zero-length guard. A remote attacker can exploit this by providing a zero-length salt parameter to key generation functions, such as blst_keygen_v5(), if the application exposes this functionality. Successful exploitation leads to memory corruption and immediate process termination, resulting in a denial-of-service (DoS) condition.

References

Affected products

blst
  • =<0.3.16

Matching in nixpkgs

Ignored packages (1)

Package maintainers

created 1 month ago
Stack-based buffer overflow in xnview.exe in XnView before 2.03 allows …

Stack-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted image layer in an XCF file.

Affected products

XnView
  • ==before 2.03

Matching in nixpkgs

Package maintainers

updated 1 month ago by @pyrox0 Activity log
  • Created automatic suggestion
  • @pyrox0 removed
    12 packages
    • canokey-qemu
    • ubootQemuX86
    • ubootQemuX86_64
    • ubootQemuAarch64
    • qemu-python-utils
    • armTrustedFirmwareQemu
    • python312Packages.qemu
    • python313Packages.qemu
    • python314Packages.qemu
    • python312Packages.qemu-qmp
    • python313Packages.qemu-qmp
    • python314Packages.qemu-qmp
The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does …

The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.

References

Affected products

QEMU
  • ==before 2.4.0.1

Matching in nixpkgs

Ignored packages (12)

Package maintainers

created 1 month ago
A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and …

A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function names.

References

Affected products

MediaWiki
  • ==before 1.19.5 and 1.20.x before 1.20.4

Matching in nixpkgs

Package maintainers

created 1 month ago
Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h …

Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service (vncviewer crash) and possibly execute arbitrary code via vectors related to screen image rendering.

Affected products

TigerVNC
  • ==before 1.3.1

Matching in nixpkgs