Nixpkgs security tracker

Dismissed

(no matching packages found)

Permalink CVE-2026-12493

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).

References

https://wpscan.com/vulnerability/b9f3f6d8-b56f-4d0e-9102-c69e6756ab74/ technical-descriptionvdb-entryexploit

Affected products

Clover Payment Gateway by Zaytech for WooCommerce

<1.3.6

Dismissed

(max. allowed matches exceeded)

Permalink CVE-2026-43781

created 1 month, 1 week ago Activity log

Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago

A race condition was addressed with improved state handling. This …

A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access sensitive user data.

References

Affected products

macOS

<15.7.8
<26.6
<14.8.8

Dismissed

(max. allowed matches exceeded)

Permalink CVE-2026-64774

created 1 month, 1 week ago Activity log

Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago

An integer overflow was addressed with improved input validation. This …

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.

References

Affected products

tvOS

<26.6

macOS

<26.6
<15.7.8
<14.8.8

visionOS

<26.6

iOS and iPadOS

<26.6

Dismissed

(max. allowed matches exceeded)

Permalink CVE-2026-43723

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month, 1 week ago Activity log

Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago

A path handling issue was addressed with improved validation. This …

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to gain root privileges.

References

Affected products

tvOS

<26.6

macOS

<26.6
<15.7.8
<14.8.8

watchOS

<26.6

visionOS

<26.6

iOS and iPadOS

<26.6

Dismissed

(no matching packages found)

Permalink CVE-2026-66391

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

Apache Wicket: leaked and missing CSP headers

Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue.

References

Affected products

Apache Wicket

=<10.9.0
=<9.23.0

Dismissed

(max. allowed matches exceeded)

Permalink CVE-2026-64730

created 1 month, 1 week ago Activity log

Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago

The issue was addressed with improved UI. This issue is …

The issue was addressed with improved UI. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Visiting a website that frames malicious content may lead to UI spoofing.

References

Affected products

tvOS

<26.6

macOS

<26.6

Safari

<26.6

watchOS

<26.6

visionOS

<26.6

iOS and iPadOS

<26.6

Dismissed

(max. allowed matches exceeded)

Permalink CVE-2026-43730

created 1 month, 1 week ago Activity log

Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago

A permissions issue was addressed with additional restrictions. This issue …

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user.

References

Affected products

tvOS

<26.6

macOS

<26.6

watchOS

<26.6

visionOS

<26.6

iOS and iPadOS

<26.6

Dismissed

(max. allowed matches exceeded)

Permalink CVE-2026-43812

created 1 month, 1 week ago Activity log

Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago

A use after free issue was addressed with improved memory …

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. An app may be able to cause unexpected system termination.

References

Affected products

tvOS

<26.6

macOS

<26.6
<15.7.8

visionOS

<26.6

iOS and iPadOS

<26.6

Dismissed

(max. allowed matches exceeded)

Permalink CVE-2026-64553

created 1 month, 1 week ago Activity log

Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago

net: psample: fix info leak in PSAMPLE_ATTR_DATA

In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLE_ATTR_DATA psample open codes nla_put() presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr is padded to 4B and data_len may not be divisible by 4B.

References

Affected products

Linux

<aedd02af1f8b0bceb7f42f5a21c41634ca9ed390
<4.11
<0d3ea2ccddda442077fc44f11d873209c97ec50b
<befe1ebe7fc2c65c80074bc34ceeb0a721ed3cd2
==4.11
<e2fa322782a2d7d8078f7bb20817e0aa9f7c32e9
<48930f6c59fd0056c2de46ce52bfe27d9c9e5eb6
<a6cfb924ad74efce254e99c197d2e3863de70868
=<6.18.*
=<6.1.*
=<6.6.*
=<5.15.*
=<6.12.*
=<*
<794a0d8bdbb39e083ed42caccb86d687a9b53570
<7fe7e6949964aa8ee6305f09db2dc9eede977bb3
=<7.1.*
=<5.10.*

Dismissed

(no matching packages found)

Permalink CVE-2026-13400

6.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.

References

https://wpscan.com/vulnerability/501b2929-3216-4587-8124-088fd51becf1/ technical-descriptionexploitvdb-entry

Affected products

Simply Schedule Appointments

<1.6.12.4

Dismissed suggestions

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products