Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Dismissed suggestions

These automatic suggestions were dismissed after initial triaging.

to select a suggestion for revision.

View:
Compact
Detailed
Dismissed
(no matching packages found)
Permalink CVE-2026-65877
8.2 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 1 month, 1 week ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector.

Affected products

SP Page Builder extension for Joomla
  • ==1.0.0-6.7.0
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-64749
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
The issue was addressed with improved memory handling. This issue …

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, visionOS 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory.

Affected products

macOS
  • <26.6
  • <15.7.8
visionOS
  • <26.6
iOS and iPadOS
  • <26.6
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-43793
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
An issue existed in the handling of environment variables. This …

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.

Affected products

macOS
  • <26.6
  • <14.8.8
  • <15.7.8
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-64765
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
An integer overflow was addressed with improved input validation. This …

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

Affected products

tvOS
  • <26.6
macOS
  • <26.6
  • <14.8.8
  • <15.7.8
watchOS
  • <26.6
visionOS
  • <26.6
iOS and iPadOS
  • <26.6
Dismissed
(no matching packages found)
Permalink CVE-2026-64741
created 1 month, 1 week ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago
A permissions issue was addressed with additional restrictions. This issue …

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to read a persistent device identifier.

Affected products

tvOS
  • <26.6
watchOS
  • <26.6
visionOS
  • <26.6
iOS and iPadOS
  • <26.6
Dismissed
(no matching packages found)
Permalink CVE-2026-65557
5.9 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
created 1 month, 1 week ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago
WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability

Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

Affected products

woocommerce-abandoned-cart
  • =<6.8.0
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-64737
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
An authorization issue was addressed with improved state management. This …

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox.

Affected products

macOS
  • <26.6
  • <14.8.8
  • <15.7.8
Dismissed
(no matching packages found)
Permalink CVE-2026-59686
8.4 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Adjacent (A)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Adjacent (A)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 month, 1 week ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.

Affected products

LoadMaster
  • <7.2.63.3
  • <7.2.54.19
MOVEit WAF
  • <7.2.63.3
ECS Connection Manager
  • <7.2.63.3
Object Scale Connection Manager
  • <7.2.63.3
Dismissed
(no matching packages found)
Permalink CVE-2026-59539
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 1 month, 1 week ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago
WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.

Affected products

paid-member-subscriptions
  • =<3.0.7
Dismissed
(max. allowed matches exceeded)
Permalink CVE-2026-64744
created 1 month, 1 week ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion 1 month, 1 week ago
An information leakage was addressed with additional validation. This issue …

An information leakage was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to disclose kernel memory.

Affected products

macOS
  • <26.6
  • <14.8.8
  • <15.7.8