Nixpkgs security tracker

Try the new UI
Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2026-90793
2.1 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 2 weeks ago Activity log
  • Created suggestion 2 weeks ago
GPAC MP4Box base_scenegraph.c gf_node_get_name use after free

A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is recommended to address this issue. The name of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.

Affected products

GPAC
  • ==abi-16.23
  • ==f1219cde

Matching in nixpkgs

pkgs.gpac

Open Source multimedia framework for research and academic purposes

  • nixos-unstable -
  • nixos-26.05 -

pkgs.msgpack-c

MessagePack implementation for C

  • nixos-unstable -
    • nixos-unstable-small 7.0.2
  • nixos-26.05 -
    • nixos-26.05-small 6.1.0

pkgs.msgpack-cxx

MessagePack implementation for C++

  • nixos-unstable -
    • nixos-unstable-small 8.0.0
  • nixos-26.05 -
    • nixos-26.05-small 7.0.0

pkgs.msgpack-tools

Command-line tools for converting between MessagePack and JSON

  • nixos-unstable -
    • nixos-unstable-small 0.6
  • nixos-26.05 -
    • nixos-26.05-small 0.6

pkgs.phpExtensions.msgpack

PHP extension for interfacing with MessagePack

  • nixos-unstable -
    • nixos-unstable-small 3.0.0
  • nixos-26.05 -
    • nixos-26.05-small 3.0.0

Package maintainers

Permalink CVE-2026-90609
1.9 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 2 weeks ago Activity log
  • Created suggestion 2 weeks ago
GPAC MP4Box vrml_tools.c null pointer dereference

A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

Affected products

GPAC
  • ==abi-16.23
  • ==f1219cde

Matching in nixpkgs

pkgs.gpac

Open Source multimedia framework for research and academic purposes

  • nixos-unstable -
  • nixos-26.05 -

pkgs.msgpack-c

MessagePack implementation for C

  • nixos-unstable -
    • nixos-unstable-small 7.0.2
  • nixos-26.05 -
    • nixos-26.05-small 6.1.0

pkgs.msgpack-cxx

MessagePack implementation for C++

  • nixos-unstable -
    • nixos-unstable-small 8.0.0
  • nixos-26.05 -
    • nixos-26.05-small 7.0.0

pkgs.msgpack-tools

Command-line tools for converting between MessagePack and JSON

  • nixos-unstable -
    • nixos-unstable-small 0.6
  • nixos-26.05 -
    • nixos-26.05-small 0.6

pkgs.phpExtensions.msgpack

PHP extension for interfacing with MessagePack

  • nixos-unstable -
    • nixos-unstable-small 3.0.0
  • nixos-26.05 -
    • nixos-26.05-small 3.0.0

Package maintainers

Permalink CVE-2026-90829
1.9 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 2 weeks ago Activity log
  • Created suggestion 2 weeks ago
GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference

A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.

Affected products

Binutils
  • ==2.47

Matching in nixpkgs

pkgs.bintools

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutils

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.bintoolsNoLibc

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutilsNoLibc

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.cargo-binutils

Cargo subcommands to invoke the LLVM tools shipped with the Rust toolchain

  • nixos-unstable -
    • nixos-unstable-small 0.4.0
  • nixos-26.05 -
    • nixos-26.05-small 0.4.0

pkgs.binutils_nogold

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.darwin.binutils

System binary utilities (wrapper script)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.bintools-unwrapped

Tools for manipulating binaries (linker, assembler, etc.)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutils-unwrapped

Tools for manipulating binaries (linker, assembler, etc.)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutils-unwrapped_2_38

Tools for manipulating binaries (linker, assembler, etc.)

  • nixos-unstable -
    • nixos-unstable-small 2.38
  • nixos-26.05 -
    • nixos-26.05-small 2.38
Permalink CVE-2026-90715
5.5 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 2 weeks ago Activity log
  • Created suggestion 2 weeks ago
marcobambini Gravity udp json-parser gravity_json.c integer overflow

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.8 mitigates this issue. The name of the patch is 9b337c3eae5833c3956bed1fc01c21c14fd443f2. Upgrading the affected component is recommended.

Affected products

Gravity
  • ==0.9.1
  • ==0.9.4
  • ==0.9.0
  • ==0.9.2
  • ==0.9.5
  • ==0.9.7
  • ==0.9.3
  • ==0.9.8
  • ==0.9.6

Matching in nixpkgs

pkgs.antigravity

Agentic development platform, evolving the IDE into the agent-first era

  • nixos-unstable -
    • nixos-unstable-small 2.5.5
  • nixos-26.05 -

pkgs.antigravity-acp

Google's AI coding agent. Official ACP server powered by Antigravity

  • nixos-unstable -
    • nixos-unstable-small 1.2.1

pkgs.antigravity-cli

Google's Go-based terminal user interface (TUI) agent client

  • nixos-unstable -
    • nixos-unstable-small 1.2.9

pkgs.antigravity-fhs

Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications

  • nixos-unstable -
    • nixos-unstable-small 2.5.5
  • nixos-26.05 -

pkgs.antigravity-hub

Desktop environment for managing multiple autonomous agents across independent projects

  • nixos-unstable -

pkgs.antigravity-ide

Agentic development platform, evolving the IDE into the agent-first era

  • nixos-unstable -
    • nixos-unstable-small 2.5.5

pkgs.antigravity-ide-fhs

Wrapped variant of antigravity-ide which launches in a FHS compatible environment, should allow for easy usage of extensions without nix-specific modifications

  • nixos-unstable -
    • nixos-unstable-small 2.5.5

pkgs.stardust-xr-gravity

Utility to launch apps and stardust clients at an offset

  • nixos-unstable -
  • nixos-26.05 -
Permalink CVE-2026-90803
1.9 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 2 weeks ago Activity log
  • Created suggestion 2 weeks ago
GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow

A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_64_relocate_section of the file bfd/elf64-x86-64.c of the component ld. Such manipulation of the argument roff leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 2.48 addresses this issue. The name of the patch is 471130b39c03623ec6d78ece377ff4da3f6bfe7b. It is recommended to upgrade the affected component.

Affected products

Binutils
  • ==2.48
  • ==2.47

Matching in nixpkgs

pkgs.bintools

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutils

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.bintoolsNoLibc

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutilsNoLibc

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.cargo-binutils

Cargo subcommands to invoke the LLVM tools shipped with the Rust toolchain

  • nixos-unstable -
    • nixos-unstable-small 0.4.0
  • nixos-26.05 -
    • nixos-26.05-small 0.4.0

pkgs.binutils_nogold

Tools for manipulating binaries (linker, assembler, etc.) (wrapper script)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.darwin.binutils

System binary utilities (wrapper script)

  • nixos-unstable -
  • nixos-26.05 -

pkgs.bintools-unwrapped

Tools for manipulating binaries (linker, assembler, etc.)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutils-unwrapped

Tools for manipulating binaries (linker, assembler, etc.)

  • nixos-unstable -
    • nixos-unstable-small 2.46
  • nixos-26.05 -
    • nixos-26.05-small 2.46

pkgs.binutils-unwrapped_2_38

Tools for manipulating binaries (linker, assembler, etc.)

  • nixos-unstable -
    • nixos-unstable-small 2.38
  • nixos-26.05 -
    • nixos-26.05-small 2.38
Permalink CVE-2026-87473
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 2 weeks ago Activity log
  • Created suggestion 2 weeks ago
Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 …

Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

Affected products

Chrome
  • <153.0.8010.36

Matching in nixpkgs

pkgs.netflix

Open Netflix in Google Chrome app mode

  • nixos-unstable -
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small

pkgs.mkchromecast

Cast macOS and Linux Audio/Video to your Google Cast and Sonos Devices

pkgs.chrome-export

Scripts to save Google Chrome's bookmarks and history as HTML bookmarks files

  • nixos-unstable -
    • nixos-unstable-small 2.0.2
  • nixos-26.05 -
    • nixos-26.05-small 2.0.2

pkgs.go-chromecast

CLI for Google Chromecast, Home devices and Cast Groups

  • nixos-unstable -
    • nixos-unstable-small 0.3.4
  • nixos-26.05 -
    • nixos-26.05-small 0.3.4

pkgs.xf86videoopenchrome

VIA Technologies UniChrome and Chrome9 IGP video driver for the Xorg X server

  • nixos-unstable -
  • nixos-26.05 -

pkgs.chrome-token-signing

Chrome and Firefox extension for signing with your eID on the web

  • nixos-unstable -
    • nixos-unstable-small 1.1.5
  • nixos-26.05 -
    • nixos-26.05-small 1.1.5

pkgs.electron-chromedriver

WebDriver server for running Selenium tests on Chrome

  • nixos-unstable -
  • nixos-26.05 -

pkgs.xf86-video-openchrome

VIA Technologies UniChrome and Chrome9 IGP video driver for the Xorg X server

  • nixos-unstable -
  • nixos-26.05 -

pkgs.gnomeExtensions.monochrome-toggle

Quick Settings toggle for monochrome, desatured or sepia tinted display. Based on Achroma.

  • nixos-unstable -
    • nixos-unstable-small 1
Permalink CVE-2026-90791
2.1 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 2 weeks ago Activity log
  • Created suggestion 2 weeks ago
GPAC MP4Box base_scenegraph.c gf_node_unregister use after free

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to resolve this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.

Affected products

GPAC
  • ==abi-16.23
  • ==f1219cde

Matching in nixpkgs

pkgs.gpac

Open Source multimedia framework for research and academic purposes

  • nixos-unstable -
  • nixos-26.05 -

pkgs.msgpack-c

MessagePack implementation for C

  • nixos-unstable -
    • nixos-unstable-small 7.0.2
  • nixos-26.05 -
    • nixos-26.05-small 6.1.0

pkgs.msgpack-cxx

MessagePack implementation for C++

  • nixos-unstable -
    • nixos-unstable-small 8.0.0
  • nixos-26.05 -
    • nixos-26.05-small 7.0.0

pkgs.msgpack-tools

Command-line tools for converting between MessagePack and JSON

  • nixos-unstable -
    • nixos-unstable-small 0.6
  • nixos-26.05 -
    • nixos-26.05-small 0.6

pkgs.phpExtensions.msgpack

PHP extension for interfacing with MessagePack

  • nixos-unstable -
    • nixos-unstable-small 3.0.0
  • nixos-26.05 -
    • nixos-26.05-small 3.0.0

Package maintainers

Permalink CVE-2026-90698
5.5 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 2 weeks ago Activity log
  • Created suggestion 2 weeks ago
memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-bounds

A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component.

Affected products

memcached
  • ==1.6.42
  • ==1.6.43
  • ==1.6.41
  • ==1.6.44

Matching in nixpkgs

pkgs.memcached

Distributed memory object caching system

  • nixos-unstable -
  • nixos-26.05 -

pkgs.libmemcached

Open source C/C++ client library and tools for the memcached server

  • nixos-unstable -
    • nixos-unstable-small 1.1.4
  • nixos-26.05 -

pkgs.memcachedTestHook

None

  • nixos-unstable -
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small

pkgs.memcached-exporter

Exports metrics from memcached servers for consumption by Prometheus

  • nixos-unstable -
  • nixos-26.05 -

pkgs.phpExtensions.memcached

PHP extension for interfacing with memcached via libmemcached library

  • nixos-unstable -
    • nixos-unstable-small 3.4.0
  • nixos-26.05 -
    • nixos-26.05-small 3.4.0

pkgs.php82Extensions.memcached

PHP extension for interfacing with memcached via libmemcached library

  • nixos-unstable -
    • nixos-unstable-small 3.4.0
  • nixos-26.05 -
    • nixos-26.05-small 3.4.0

pkgs.php83Extensions.memcached

PHP extension for interfacing with memcached via libmemcached library

  • nixos-unstable -
    • nixos-unstable-small 3.4.0
  • nixos-26.05 -
    • nixos-26.05-small 3.4.0

pkgs.php84Extensions.memcached

PHP extension for interfacing with memcached via libmemcached library

  • nixos-unstable -
    • nixos-unstable-small 3.4.0
  • nixos-26.05 -
    • nixos-26.05-small 3.4.0

pkgs.php85Extensions.memcached

PHP extension for interfacing with memcached via libmemcached library

  • nixos-unstable -
    • nixos-unstable-small 3.4.0
  • nixos-26.05 -
    • nixos-26.05-small 3.4.0

Package maintainers

Permalink CVE-2026-5132
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
created 2 weeks ago Activity log
  • Created suggestion 2 weeks ago
Unbounded zlib decompression in Calls SDP WebSocket messages

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643

References

Affected products

Mattermost
  • ==11.8.5
  • ==11.10.0
  • ==11.9.1
  • ==10.11.23
  • =<11.9.0
  • =<10.11.22
  • =<11.7.7
  • ==11.7.8
  • =<11.8.4

Matching in nixpkgs

pkgs.mattermost

Open source platform for secure collaboration across the entire software development lifecycle

  • nixos-unstable -
  • nixos-26.05 -

pkgs.mattermostLatest

Open source platform for secure collaboration across the entire software development lifecycle

  • nixos-unstable -
  • nixos-26.05 -

Package maintainers

Permalink CVE-2026-82049
8.4 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Passive (P)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Passive (P)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 2 weeks ago Activity log
  • Created suggestion 2 weeks ago
tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

Affected products

CPython
  • <3.14.0

Matching in nixpkgs

Package maintainers