Nixpkgs security tracker

Dismissed

(no matching packages found)

Permalink CVE-2026-11803

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

PDF File Parsing Out-of-Bounds Read Vulnerability in Autodesk Revit

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0011 vendor-advisory
https://www.autodesk.com/products/autodesk-access/overview patch

Affected products

Revit

<2027.2.0
<2026.5.0

Dismissed

(no matching packages found)

Permalink CVE-2026-69125

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

None

Affected products

Dismissed

(no matching packages found)

Permalink CVE-2026-12713

9.1 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

References

https://wpscan.com/vulnerability/5fecb389-c327-4084-a5c8-61e5098386d6/ exploittechnical-descriptionvdb-entry

Affected products

WPCargo Track & Trace

<8.0.4

Dismissed

(no matching packages found)

Permalink CVE-2026-18395

5.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

References

https://wpscan.com/vulnerability/999656c5-2e2d-4af8-9941-36184545f487/ exploittechnical-descriptionvdb-entry

Affected products

Child Pages Card

<1.09

Dismissed

(no matching packages found)

Permalink CVE-2026-14547

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

Estatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request Form

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing.

References

https://wpscan.com/vulnerability/5c208be8-57db-4f74-8030-398c1eece293/ exploittechnical-descriptionvdb-entry

Affected products

Estatik Real Estate Plugin

<4.3.3

Dismissed

(no matching packages found)

Permalink CVE-2026-67688

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

ICS-Park Smart Park Management System v2.0 contains an unrestricted file …

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code.

References

Affected products

n/a

==n/a

Dismissed

(no matching packages found)

Permalink CVE-2026-16954

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.

References

https://wpscan.com/vulnerability/badce355-e6ce-4dd4-8d9b-c87a7b9db12f/ exploittechnical-descriptionvdb-entry

Affected products

AI Engine

<3.6.4

Dismissed

(no matching packages found)

Permalink CVE-2026-65502

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.

References

https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack-lite/vul… vdb-entry

Affected products

bdthemes-element-pack-lite

=<8.7.13

Dismissed

(no matching packages found)

Permalink CVE-2026-65513

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.

References

https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/v… vdb-entry

Affected products

simply-schedule-appointments

=<1.6.12.10

Dismissed

(no matching packages found)

Permalink CVE-2026-66699

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 month ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month ago

WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability

Custom role Broken Access Control in Dokan <= 5.0.10 versions.

References

https://patchstack.com/database/wordpress/plugin/dokan-lite/vulnerability/wordp… vdb-entry

Affected products

dokan-lite

=<5.0.10

Dismissed suggestions

References

Affected products

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products