Nixpkgs security tracker
Dismissed
(no matching packages found)
Permalink
CVE-2026-48295
7.5 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
Activity log
- Created & dismissed (no matching packages found) suggestion
CAI Content Credentials | Insufficiently Protected Credentials (CWE-522)
CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attacker could leverage this vulnerability to gain unauthorized read access. Exploitation of this issue does not require user interaction.
References
Affected products
Content Credentials JS SDK
- ==@contentauth/c2pa-web@0.9.0
- =<@contentauth/c2pa-web@0.7.0
Content Credentials Rust SDK
- ==c2pa-v0.85.2
- =<c2pa-v0.84.0
Content Credentials Command-Line Tool
- =<c2patool-v0.16.5
- ==c2patool-v0.26.65