Nixpkgs security tracker

Permalink CVE-2026-12503

9.2 CRITICAL

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month ago Activity log

Created suggestion 1 month ago

Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter

Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.

References

https://www.loytec.com/support/product-security/advisories/8520-dibt-cve-202605… vendor-advisory

Affected products

L-INX

=<8.4.16

L-IOB

=<8.4.16

L-PAD

=<8.4.16

L-ROC

=<8.4.16

L-VIS

=<8.4.16

L-DALI

=<8.4.16

L-GATE

=<8.4.16

LIP-ME20xC

=<8.4.16

Matching in nixpkgs

pkgs.sil-padauk

Unicode-based font family with broad support for writing systems that use the Myanmar script

nixos-unstable -
- nixos-unstable-small 5.100
nixos-26.05 -
- nixos-26.05-small 5.100

pkgs.haskellPackages.gogol-vision

Google Cloud Vision SDK

nixos-unstable -
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0

pkgs.haskellPackages.fgl-visualize

Convert FGL graphs to dot (graphviz) files

nixos-unstable -
- nixos-unstable-small 0.1.0.1
nixos-26.05 -
- nixos-26.05-small 0.1.0.1

Package maintainers

@serge-belov Serge Belov <sb@canva.com>

Permalink CVE-2026-55728

3.8 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Unreported (U)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 1 month ago Activity log

Created suggestion 1 month ago

Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict

Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.

References

https://www.loytec.com/support/product-security/advisories/8523-dibt-cve-202605… vendor-advisory

Affected products

L-INX

=<8.4.16

L-IOB

=<8.4.16

L-PAD

=<8.4.16

L-ROC

=<8.4.16

L-VIS

=<8.4.16

L-DALI

=<8.4.16

L-GATE

=<8.4.16

LIP-ME20xC

=<8.4.16

Matching in nixpkgs

pkgs.sil-padauk

Unicode-based font family with broad support for writing systems that use the Myanmar script

nixos-unstable 5.100
- nixpkgs-unstable 5.100
- nixos-unstable-small 5.100
nixos-26.05 5.100
- nixos-26.05-small 5.100
- nixpkgs-26.05-darwin 5.100

pkgs.haskellPackages.gogol-vision

Google Cloud Vision SDK

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.haskellPackages.fgl-visualize

Convert FGL graphs to dot (graphviz) files

nixos-unstable 0.1.0.1
- nixpkgs-unstable 0.1.0.1
- nixos-unstable-small 0.1.0.1
nixos-26.05 0.1.0.1
- nixos-26.05-small 0.1.0.1
- nixpkgs-26.05-darwin 0.1.0.1

Package maintainers

@serge-belov Serge Belov <sb@canva.com>

Permalink CVE-2026-12502

8.4 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month ago Activity log

Created suggestion 1 month ago

Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo

Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.

References

https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-202605… vendor-advisory

Affected products

L-INX

=<8.4.16

L-IOB

=<8.4.16

L-PAD

=<8.4.16

L-ROC

=<8.4.16

L-VIS

=<8.4.16

L-DALI

=<8.4.16

L-GATE

=<8.4.16

LIP-ME20xC

=<8.4.16

Matching in nixpkgs

pkgs.sil-padauk

Unicode-based font family with broad support for writing systems that use the Myanmar script

nixos-unstable -
- nixos-unstable-small 5.100
nixos-26.05 -
- nixos-26.05-small 5.100

pkgs.haskellPackages.gogol-vision

Google Cloud Vision SDK

nixos-unstable -
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0

pkgs.haskellPackages.fgl-visualize

Convert FGL graphs to dot (graphviz) files

nixos-unstable -
- nixos-unstable-small 0.1.0.1
nixos-26.05 -
- nixos-26.05-small 0.1.0.1

Package maintainers

@serge-belov Serge Belov <sb@canva.com>

Permalink CVE-2026-12496

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month ago Activity log

Created suggestion 1 month ago

Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server

Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.

References

https://www.loytec.com/support/product-security/advisories/8522-dibt-cve-202605… vendor-advisory

Affected products

L-INX

=<8.4.16

L-IOB

=<8.4.16

L-PAD

=<8.4.16

L-ROC

=<8.4.16

L-VIS

=<8.4.16

L-DALI

=<8.4.16

L-GATE

=<8.4.16

LIP-ME20xC

=<8.4.16

Matching in nixpkgs

pkgs.sil-padauk

Unicode-based font family with broad support for writing systems that use the Myanmar script

nixos-unstable 5.100
- nixpkgs-unstable 5.100
- nixos-unstable-small 5.100
nixos-26.05 5.100
- nixos-26.05-small 5.100
- nixpkgs-26.05-darwin 5.100

pkgs.haskellPackages.gogol-vision

Google Cloud Vision SDK

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.haskellPackages.fgl-visualize

Convert FGL graphs to dot (graphviz) files

nixos-unstable 0.1.0.1
- nixpkgs-unstable 0.1.0.1
- nixos-unstable-small 0.1.0.1
nixos-26.05 0.1.0.1
- nixos-26.05-small 0.1.0.1
- nixpkgs-26.05-darwin 0.1.0.1

Package maintainers

@serge-belov Serge Belov <sb@canva.com>

Permalink CVE-2026-12504

8.4 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month ago Activity log

Created suggestion 1 month ago

Loytec LINX firmware: Improper Authentication in PAM configuration

Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.

References

https://www.loytec.com/support/product-security/advisories/8521-dibt-cve-202605… vendor-advisory

Affected products

L-INX

=<8.4.16

L-IOB

=<8.4.16

L-PAD

=<8.4.16

L-ROC

=<8.4.16

L-VIS

=<8.4.16

L-DALI

=<8.4.16

L-GATE

=<8.4.16

LIP-ME20xC

=<8.4.16

Matching in nixpkgs

pkgs.sil-padauk

Unicode-based font family with broad support for writing systems that use the Myanmar script

nixos-unstable -
- nixos-unstable-small 5.100
nixos-26.05 -
- nixos-26.05-small 5.100

pkgs.haskellPackages.gogol-vision

Google Cloud Vision SDK

nixos-unstable -
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0

pkgs.haskellPackages.fgl-visualize

Convert FGL graphs to dot (graphviz) files

nixos-unstable -
- nixos-unstable-small 0.1.0.1
nixos-26.05 -
- nixos-26.05-small 0.1.0.1

Package maintainers

@serge-belov Serge Belov <sb@canva.com>

Permalink CVE-2026-55732

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month ago Activity log

Created suggestion 1 month ago

Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)

Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.

References

https://www.loytec.com/support/product-security/advisories/8532-dibt-cve-202606… vendor-advisory

Affected products

L-INX

=<8.4.18

L-IOB

=<8.4.18

L-PAD

=<8.4.18

L-ROC

=<8.4.18

L-VIS

=<8.4.18

L-DALI

=<8.4.18

L-GATE

=<8.4.18

LIP-ME20xC

=<8.4.18

Matching in nixpkgs

pkgs.sil-padauk

Unicode-based font family with broad support for writing systems that use the Myanmar script

nixos-unstable -
- nixos-unstable-small 5.100
nixos-26.05 -
- nixos-26.05-small 5.100

pkgs.haskellPackages.gogol-vision

Google Cloud Vision SDK

nixos-unstable -
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0

pkgs.haskellPackages.fgl-visualize

Convert FGL graphs to dot (graphviz) files

nixos-unstable -
- nixos-unstable-small 0.1.0.1
nixos-26.05 -
- nixos-26.05-small 0.1.0.1

Package maintainers

@serge-belov Serge Belov <sb@canva.com>

Permalink CVE-2026-55731

6.6 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Unreported (U)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 1 month ago Activity log

Created suggestion 1 month ago

Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent

Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component.

References

https://www.loytec.com/support/product-security/advisories/8531-dibt-cve-202606… vendor-advisory

Affected products

L-INX

=<8.4.16

L-IOB

=<8.4.16

L-PAD

=<8.4.16

L-ROC

=<8.4.16

L-VIS

=<8.4.16

L-DALI

=<8.4.16

L-GATE

=<8.4.16

LIP-ME20xC

=<8.4.16

Matching in nixpkgs

pkgs.sil-padauk

Unicode-based font family with broad support for writing systems that use the Myanmar script

nixos-unstable -
- nixos-unstable-small 5.100
nixos-26.05 -
- nixos-26.05-small 5.100

pkgs.haskellPackages.gogol-vision

Google Cloud Vision SDK

nixos-unstable -
- nixos-unstable-small 1.0.0
nixos-26.05 -
- nixos-26.05-small 1.0.0

pkgs.haskellPackages.fgl-visualize

Convert FGL graphs to dot (graphviz) files

nixos-unstable -
- nixos-unstable-small 0.1.0.1
nixos-26.05 -
- nixos-26.05-small 0.1.0.1

Package maintainers

@serge-belov Serge Belov <sb@canva.com>

Permalink CVE-2026-65918

7.1 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

PyTorch torchvision GIF Decoder Out-of-bounds Heap Read

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.

References

Researcher Disclosure technical-descriptionexploit
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/pytorch-torchvision-gif-decoder-out-of-bou… third-party-advisory

Affected products

vision

==4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed
=<0.28.0

Matching in nixpkgs

pkgs.television

Blazingly fast general purpose fuzzy finder TUI

nixos-unstable 0.15.9
- nixpkgs-unstable 0.15.9
- nixos-unstable-small 0.15.9
nixos-26.05 0.15.6
- nixos-26.05-small 0.15.6
- nixpkgs-26.05-darwin 0.15.6

pkgs.autorevision

Extracts revision metadata from your VCS repository

nixos-unstable 1.22
- nixpkgs-unstable 1.22
- nixos-unstable-small 1.22
nixos-26.05 1.22
- nixos-26.05-small 1.22
- nixpkgs-26.05-darwin 1.22

pkgs.photonvision

Free, fast, and easy-to-use computer vision solution for the FIRST Robotics Competition

nixos-unstable 2025.2.1
- nixpkgs-unstable 2025.2.1
- nixos-unstable-small 2025.2.1
nixos-26.05 2025.2.1
- nixos-26.05-small 2025.2.1
- nixpkgs-26.05-darwin 2025.2.1

pkgs.kanidm-provision

Small utility to help with kanidm provisioning

nixos-unstable 1.3.0
- nixpkgs-unstable 1.3.0
- nixos-unstable-small 1.3.0
nixos-26.05 1.3.0
- nixos-26.05-small 1.3.0
- nixpkgs-26.05-darwin 1.3.0

pkgs.influxdb2-provision

Small utility to help provisioning influxdb2

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.elmPackages.elm-test

Runs elm-test suites from Node.js

nixos-unstable 0.19.1-revision17
- nixpkgs-unstable 0.19.1-revision17
- nixos-unstable-small 0.19.1-revision17
nixos-26.05 0.19.1-revision17
- nixos-26.05-small 0.19.1-revision17
- nixpkgs-26.05-darwin 0.19.1-revision17

pkgs.rocmPackages.mivisionx

Set of comprehensive computer vision and machine intelligence libraries, utilities, and applications

nixos-unstable 7.2.3
- nixpkgs-unstable 7.2.3
- nixos-unstable-small 7.2.3
nixos-26.05 7.2.3
- nixos-26.05-small 7.2.3
- nixpkgs-26.05-darwin 7.2.3

pkgs.simple-revision-control

Simple single-file revision control

nixos-unstable 1.41
- nixpkgs-unstable 1.41
- nixos-unstable-small 1.41
nixos-26.05 1.41
- nixos-26.05-small 1.41
- nixpkgs-26.05-darwin 1.41

pkgs.thin-provisioning-tools

Suite of tools for manipulating the metadata of the dm-thin device-mapper target

nixos-unstable 1.3.2
- nixpkgs-unstable 1.3.2
- nixos-unstable-small 1.3.2
nixos-26.05 1.3.2
- nixos-26.05-small 1.3.2
- nixpkgs-26.05-darwin 1.3.2

pkgs.gnomeExtensions.my-vision

MyVision is a fork of Display Configuration Switcher that has been thoughtfully and substantially enhanced. It allows users to store profiles that are directly bound to specific display devices. This approach eliminates the need for redundant profiles in scenarios where video outputs are detected or ordered unpredictably.

nixos-unstable 12
- nixpkgs-unstable 12
- nixos-unstable-small 12
nixos-26.05 12
- nixos-26.05-small 12
- nixpkgs-26.05-darwin 12

pkgs.python313Packages.visions

Type system for data analysis in Python

nixos-unstable 0.8.1
- nixpkgs-unstable 0.8.1
- nixos-unstable-small 0.8.2
nixos-26.05 0.8.1
- nixos-26.05-small 0.8.1
- nixpkgs-26.05-darwin 0.8.1

pkgs.python314Packages.visions

Type system for data analysis in Python

nixos-unstable 0.8.1
- nixpkgs-unstable 0.8.1
- nixos-unstable-small 0.8.2
nixos-26.05 0.8.1
- nixos-26.05-small 0.8.1
- nixpkgs-26.05-darwin 0.8.1

pkgs.rocmPackages.mivisionx-cpu

Set of comprehensive computer vision and machine intelligence libraries, utilities, and applications

nixos-unstable 7.2.3
- nixpkgs-unstable 7.2.3
- nixos-unstable-small 7.2.3
nixos-26.05 7.2.3
- nixos-26.05-small 7.2.3
- nixpkgs-26.05-darwin 7.2.3

pkgs.rocmPackages.mivisionx-hip

Set of comprehensive computer vision and machine intelligence libraries, utilities, and applications

nixos-unstable 7.2.3
- nixpkgs-unstable 7.2.3
- nixos-unstable-small 7.2.3
nixos-26.05 7.2.3
- nixos-26.05-small 7.2.3
- nixpkgs-26.05-darwin 7.2.3

pkgs.python313Packages.hikvision

Python module for interacting with Hikvision IP Cameras

nixos-unstable 2.0.4
- nixpkgs-unstable 2.0.4
- nixos-unstable-small 2.0.4
nixos-26.05 2.0.4
- nixos-26.05-small 2.0.4
- nixpkgs-26.05-darwin 2.0.4

pkgs.python314Packages.hikvision

Python module for interacting with Hikvision IP Cameras

nixos-unstable 2.0.4
- nixpkgs-unstable 2.0.4
- nixos-unstable-small 2.0.4
nixos-26.05 2.0.4
- nixos-26.05-small 2.0.4
- nixpkgs-26.05-darwin 2.0.4

pkgs.haskellPackages.gogol-vision

Google Cloud Vision SDK

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.haskellPackages.vcs-revision

Facilities for accessing the version control revision of the current directory

nixos-unstable 0.0.2
- nixpkgs-unstable 0.0.2
- nixos-unstable-small 0.0.2
nixos-26.05 0.0.2
- nixos-26.05-small 0.0.2
- nixpkgs-26.05-darwin 0.0.2

pkgs.python313Packages.cleanvision

Automatically find issues in image datasets and practice data-centric computer vision

nixos-unstable 0.3.7
- nixpkgs-unstable 0.3.7
- nixos-unstable-small 0.3.7
nixos-26.05 0.3.7
- nixos-26.05-small 0.3.7
- nixpkgs-26.05-darwin 0.3.7

pkgs.python313Packages.supervision

Set of easy-to-use utils that will come in handy in any Computer Vision project

nixos-unstable -
- nixpkgs-unstable 0.29.1
- nixos-unstable-small 0.29.1

pkgs.python313Packages.torchvision

PyTorch vision library

nixos-unstable 0.27.0
- nixpkgs-unstable 0.27.0
- nixos-unstable-small 0.27.0
nixos-26.05 0.26.0
- nixos-26.05-small 0.26.0
- nixpkgs-26.05-darwin 0.26.0

pkgs.python314Packages.cleanvision

Automatically find issues in image datasets and practice data-centric computer vision

nixos-unstable 0.3.7
- nixpkgs-unstable 0.3.7
- nixos-unstable-small 0.3.7
nixos-26.05 0.3.7
- nixos-26.05-small 0.3.7
- nixpkgs-26.05-darwin 0.3.7

pkgs.python314Packages.supervision

Set of easy-to-use utils that will come in handy in any Computer Vision project

nixos-unstable -
- nixpkgs-unstable 0.29.1
- nixos-unstable-small 0.29.1

pkgs.python314Packages.torchvision

PyTorch vision library

nixos-unstable 0.27.0
- nixpkgs-unstable 0.27.0
- nixos-unstable-small 0.27.0
nixos-26.05 0.26.0
- nixos-26.05-small 0.26.0
- nixpkgs-26.05-darwin 0.26.0

pkgs.kanidmWithSecretProvisioning_1_8

Simple, secure and fast identity management platform

nixos-unstable 1.8.6
- nixpkgs-unstable 1.8.6
- nixos-unstable-small 1.8.6
nixos-26.05 1.8.6
- nixos-26.05-small 1.8.6
- nixpkgs-26.05-darwin 1.8.6

pkgs.kanidmWithSecretProvisioning_1_9

Simple, secure and fast identity management platform

nixos-unstable 1.9.4
- nixpkgs-unstable 1.9.4
- nixos-unstable-small 1.9.4
nixos-26.05 1.9.4
- nixos-26.05-small 1.9.4
- nixpkgs-26.05-darwin 1.9.4

pkgs.kanidmWithSecretProvisioning_1_10

Simple, secure and fast identity management platform

nixos-unstable 1.10.3
- nixpkgs-unstable 1.10.4
- nixos-unstable-small 1.10.4
nixos-26.05 1.10.4
- nixos-26.05-small 1.10.4
- nixpkgs-26.05-darwin 1.10.4

pkgs.python313Packages.torchvision-bin

None

nixos-26.05 0.26.0
- nixos-26.05-small 0.26.0
- nixpkgs-26.05-darwin 0.26.0

pkgs.python314Packages.torchvision-bin

None

nixos-26.05 0.26.0
- nixos-26.05-small 0.26.0
- nixpkgs-26.05-darwin 0.26.0

pkgs.python313Packages.visionpluspython

Python API wrapper for Watts Vision+ smart home system

nixos-unstable 1.1.0
- nixpkgs-unstable 1.1.0
- nixos-unstable-small 1.1.0
nixos-26.05 1.0.2
- nixos-26.05-small 1.0.2
- nixpkgs-26.05-darwin 1.0.2

pkgs.python314Packages.visionpluspython

Python API wrapper for Watts Vision+ smart home system

nixos-unstable 1.1.0
- nixpkgs-unstable 1.1.0
- nixos-unstable-small 1.1.0
nixos-26.05 1.0.2
- nixos-26.05-small 1.0.2
- nixpkgs-26.05-darwin 1.0.2

pkgs.pkgsRocm.python3Packages.cleanvision

Automatically find issues in image datasets and practice data-centric computer vision

nixos-unstable 0.3.7
- nixpkgs-unstable 0.3.7
- nixos-unstable-small 0.3.7
nixos-26.05 0.3.7
- nixos-26.05-small 0.3.7
- nixpkgs-26.05-darwin 0.3.7

pkgs.pkgsRocm.python3Packages.torchvision

PyTorch vision library

nixos-unstable 0.27.0
- nixpkgs-unstable 0.27.0
- nixos-unstable-small 0.27.0
nixos-26.05 0.26.0
- nixos-26.05-small 0.26.0
- nixpkgs-26.05-darwin 0.26.0

pkgs.python313Packages.google-cloud-vision

Cloud Vision API API client library

nixos-unstable 3.14.0
- nixpkgs-unstable 3.15.0
- nixos-unstable-small 3.15.0
nixos-26.05 3.14.0
- nixos-26.05-small 3.14.0
- nixpkgs-26.05-darwin 3.14.0

pkgs.python314Packages.google-cloud-vision

Cloud Vision API API client library

nixos-unstable 3.14.0
- nixpkgs-unstable 3.15.0
- nixos-unstable-small 3.15.0
nixos-26.05 3.14.0
- nixos-26.05-small 3.14.0
- nixpkgs-26.05-darwin 3.14.0

pkgs.haskellPackages.amazonka-lookoutvision

Amazon Lookout for Vision SDK

nixos-unstable 2.0-unstable-2025-04-16
- nixpkgs-unstable 2.0-unstable-2025-04-16
- nixos-unstable-small 2.0-unstable-2025-04-16
nixos-26.05 2.0-unstable-2025-04-16
- nixos-26.05-small 2.0-unstable-2025-04-16
- nixpkgs-26.05-darwin 2.0-unstable-2025-04-16

pkgs.python313Packages.mypy-boto3-lookoutvision

Type annotations for boto3 lookoutvision

nixos-unstable 1.40.59
- nixpkgs-unstable 1.40.59
- nixos-unstable-small 1.40.59
nixos-26.05 1.40.59
- nixos-26.05-small 1.40.59
- nixpkgs-26.05-darwin 1.40.59

pkgs.python314Packages.mypy-boto3-lookoutvision

Type annotations for boto3 lookoutvision

nixos-unstable 1.40.59
- nixpkgs-unstable 1.40.59
- nixos-unstable-small 1.40.59
nixos-26.05 1.40.59
- nixos-26.05-small 1.40.59
- nixpkgs-26.05-darwin 1.40.59

pkgs.python313Packages.aliyun-python-sdk-ivision

Module of Aliyun Python SDK (ivision)

nixos-unstable -
- nixpkgs-unstable 1.2.1
- nixos-unstable-small 1.2.1

pkgs.python314Packages.aliyun-python-sdk-ivision

Module of Aliyun Python SDK (ivision)

nixos-unstable -
- nixpkgs-unstable 1.2.1
- nixos-unstable-small 1.2.1

pkgs.haskellPackages.gogol-androiddeviceprovisioning

Google Android Device Provisioning Partner SDK

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.python313Packages.azure-ai-vision-imageanalysis

Azure Image Analysis client library for Python

nixos-unstable 39.0.0
- nixpkgs-unstable 39.0.0
- nixos-unstable-small 39.0.0
nixos-26.05 39.0.0
- nixos-26.05-small 39.0.0
- nixpkgs-26.05-darwin 39.0.0

pkgs.python314Packages.azure-ai-vision-imageanalysis

Azure Image Analysis client library for Python

nixos-unstable 39.0.0
- nixpkgs-unstable 39.0.0
- nixos-unstable-small 39.0.0
nixos-26.05 39.0.0
- nixos-26.05-small 39.0.0
- nixpkgs-26.05-darwin 39.0.0

pkgs.python313Packages.aliyun-python-sdk-threedvision

Module of Aliyun Python SDK (threedvision)

nixos-unstable -
- nixpkgs-unstable 1.0.4
- nixos-unstable-small 1.0.4

pkgs.python314Packages.aliyun-python-sdk-threedvision

Module of Aliyun Python SDK (threedvision)

nixos-unstable -
- nixpkgs-unstable 1.0.4
- nixos-unstable-small 1.0.4

pkgs.python313Packages.types-aiobotocore-lookoutvision

Type annotations for aiobotocore lookoutvision

nixos-unstable 2.24.2
- nixpkgs-unstable 2.24.2
- nixos-unstable-small 2.24.2
nixos-26.05 2.24.2
- nixos-26.05-small 2.24.2
- nixpkgs-26.05-darwin 2.24.2

pkgs.python314Packages.types-aiobotocore-lookoutvision

Type annotations for aiobotocore lookoutvision

nixos-unstable -
- nixos-unstable-small 2.24.2

pkgs.python313Packages.azure-mgmt-iothubprovisioningservices

This is the Microsoft Azure IoTHub Provisioning Services Client Library

nixos-unstable 1.1.0
- nixpkgs-unstable 1.1.0
- nixos-unstable-small 1.1.0
nixos-26.05 1.1.0
- nixos-26.05-small 1.1.0
- nixpkgs-26.05-darwin 1.1.0

pkgs.python314Packages.azure-mgmt-iothubprovisioningservices

This is the Microsoft Azure IoTHub Provisioning Services Client Library

nixos-unstable 1.1.0
- nixpkgs-unstable 1.1.0
- nixos-unstable-small 1.1.0
nixos-26.05 1.1.0
- nixos-26.05-small 1.1.0
- nixpkgs-26.05-darwin 1.1.0

pkgs.python313Packages.mkdocs-git-revision-date-localized-plugin

MkDocs plugin that enables displaying the date of the last git modification of a page

nixos-unstable 1.5.3
- nixpkgs-unstable 1.5.3
- nixos-unstable-small 1.5.3
nixos-26.05 1.5.2
- nixos-26.05-small 1.5.2
- nixpkgs-26.05-darwin 1.5.2

pkgs.python314Packages.mkdocs-git-revision-date-localized-plugin

MkDocs plugin that enables displaying the date of the last git modification of a page

nixos-unstable 1.5.3
- nixpkgs-unstable 1.5.3
- nixos-unstable-small 1.5.3
nixos-26.05 1.5.2
- nixos-26.05-small 1.5.2
- nixpkgs-26.05-darwin 1.5.2

Package maintainers

@bjornfor Bjørn Forsman <bjorn.forsman@gmail.com>
@turboMaCk Marek Fajkus <marek.faj@gmail.com>
@honnip Jung seungwoo <me@honnip.page>
@oddlama oddlama <oddlama@oddlama.org>
@adamcstephens Adam C. Stephens <happy.plan4249@valkor.net>
@Flakebi Sebastian Neubauer <flakebi@t-online.de>
@max-niederman Max Niederman <max@maxniederman.com>
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>
@Sigmanificient Yohann Boniface <sigmanificient@gmail.com>
@mwilsoncoding Max Wilson <nixpkgs@maxwilson.dev>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@totoroot Matthias Thym <git@thym.at>
@JamieMagee Jamie Magee <jamie.magee@gmail.com>
@bcdarwin Ben Darwin <bcdarwin@gmail.com>
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
@GZGavinZhao Gavin Zhao
@mschwaig Martin Schwaighofer <mschwaig+nixpkgs@eml.cc>
@louis-thevenet Louis Thevenet
@getchoo Seth Flynn <getchoo@tuta.io>
@mahyarmirrashed Mahyar Mirrashed <mah.mirr@gmail.com>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.sil-padauk

pkgs.haskellPackages.gogol-vision

pkgs.haskellPackages.fgl-visualize

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.sil-padauk

pkgs.haskellPackages.gogol-vision

pkgs.haskellPackages.fgl-visualize

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.sil-padauk

pkgs.haskellPackages.gogol-vision

pkgs.haskellPackages.fgl-visualize

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.sil-padauk

pkgs.haskellPackages.gogol-vision

pkgs.haskellPackages.fgl-visualize

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.sil-padauk

pkgs.haskellPackages.gogol-vision

pkgs.haskellPackages.fgl-visualize

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.sil-padauk

pkgs.haskellPackages.gogol-vision

pkgs.haskellPackages.fgl-visualize

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.sil-padauk

pkgs.haskellPackages.gogol-vision

pkgs.haskellPackages.fgl-visualize

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.television

pkgs.autorevision

pkgs.photonvision

pkgs.kanidm-provision

pkgs.influxdb2-provision

pkgs.elmPackages.elm-test

pkgs.rocmPackages.mivisionx

pkgs.simple-revision-control

pkgs.thin-provisioning-tools

pkgs.gnomeExtensions.my-vision

pkgs.python313Packages.visions

pkgs.python314Packages.visions

pkgs.rocmPackages.mivisionx-cpu

pkgs.rocmPackages.mivisionx-hip

pkgs.python313Packages.hikvision

pkgs.python314Packages.hikvision

pkgs.haskellPackages.gogol-vision

pkgs.haskellPackages.vcs-revision

pkgs.python313Packages.cleanvision

pkgs.python313Packages.supervision

pkgs.python313Packages.torchvision

pkgs.python314Packages.cleanvision

pkgs.python314Packages.supervision

pkgs.python314Packages.torchvision

pkgs.kanidmWithSecretProvisioning_1_8

pkgs.kanidmWithSecretProvisioning_1_9

pkgs.kanidmWithSecretProvisioning_1_10