Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Dismissed suggestions

These automatic suggestions were dismissed after initial triaging.

to select a suggestion for revision.

View:
Compact
Detailed
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-43772
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
A path traversal issue was addressed with improved input validation. …

A path traversal issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to break out of its sandbox.

Affected products

macOS
  • <26.6
  • <14.8.8
  • <15.7.8
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-43809
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
An out-of-bounds read was addressed with improved bounds checking. This …

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.

Affected products

macOS
  • <26.6
  • <14.8.8
  • <15.7.8
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-43681
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
A buffer overflow was addressed with improved bounds checking. This …

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A local user may be able to read kernel memory.

Affected products

macOS
  • <26.6
  • <15.7.8
  • <14.8.8
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-43775
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
An authorization issue was addressed with improved state management. This …

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. An app may be able to access sensitive user data.

Affected products

macOS
  • <26.6
  • <15.7.8
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-43682
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
The issue was addressed with improved memory handling. This issue …

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be able to cause unexpected system termination or corrupt kernel memory.

Affected products

macOS
  • <15.7.8
  • <26.6
  • <14.8.8
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-43672
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
An authorization issue was addressed with improved state management. This …

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious application may be able to bypass Privacy preferences.

Affected products

macOS
  • <15.7.8
  • <26.6
  • <14.8.8
Dismissed
(no matching packages found)
Permalink CVE-2026-64755
created 1 month, 1 week ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago
An authorization issue was addressed with improved state management. This …

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to access sensitive user data.

Affected products

iOS and iPadOS
  • <26.6
Dismissed
(no matching packages found)
Permalink CVE-2026-14203
4.8 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
created 1 month, 1 week ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago
Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.

References

Affected products

Smart Manager
  • <8.92.0
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-64698
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
The issue was addressed with improved memory handling. This issue …

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or read kernel memory.

Affected products

macOS
  • <26.6
  • <15.7.8
  • <14.8.8
Dismissed
(no matching packages found)
Permalink CVE-2026-65561
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
created 1 month, 1 week ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago
WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

Affected products

miniorange-login-openid
  • =<7.8.0