Nixpkgs security tracker

Dismissed

(no matching packages found)

Permalink CVE-2026-59512

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

WordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.

References

https://patchstack.com/database/wordpress/plugin/enquiry-quotation-for-woocomme… vdb-entry

Affected products

enquiry-quotation-for-woocommerce

=<2.2.34.43

Dismissed

(no matching packages found)

Permalink CVE-2026-57703

6.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.

References

https://patchstack.com/database/wordpress/plugin/sunshine-photo-cart/vulnerabil… vdb-entry

Affected products

sunshine-photo-cart

=<3.6.10.1

Dismissed

(no matching packages found)

Permalink CVE-2026-25800

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers from high buffer overhead, enabling memory exhaustion. Version 0.11.15 fixes the issue.

References

https://github.com/quinn-rs/quinn/security/advisories/GHSA-4w2j-m93h-cj5j x_refsource_CONFIRM
https://github.com/quinn-rs/quinn/pull/2694 x_refsource_MISC
https://rustsec.org/advisories/RUSTSEC-2026-0185.html x_refsource_MISC

Affected products

quinn

==>= 0.1.0, < 0.11.15

Dismissed

(no matching packages found)

Permalink CVE-2026-65518

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.

References

https://patchstack.com/database/wordpress/plugin/easy-paypal-donation/vulnerabi… vdb-entry

Affected products

easy-paypal-donation

=<1.5.5

Dismissed

(no matching packages found)

Permalink CVE-2026-8287

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

Unrestricted File Upload in BizimHesap Information Systems' Online Pre-Accounting Software

Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessive Allocation. This issue affects Online Pre-Accounting Software: through 17072026.

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0620 government-resource

Affected products

Online Pre-Accounting Software

=<17072026

Dismissed

(no matching packages found)

Permalink CVE-2026-61951

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.

References

https://patchstack.com/database/wordpress/plugin/truebooker-appointment-booking… vdb-entry

Affected products

truebooker-appointment-booking

=<1.2.3

Dismissed

(no matching packages found)

Permalink CVE-2026-65687

9.3 CRITICAL

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

Bold Reports Standalone Report Designer 14.1.12 Arbitrary File Read via SVG Processing

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full unauthorized access to the application.

References

Release Notes release-notes
https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-ar… third-party-advisory

Affected products

Standalone Report Designer

<14.1.12

Dismissed

(no matching packages found)

Permalink CVE-2026-65457

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

References

https://patchstack.com/database/wordpress/plugin/yookassa/vulnerability/wordpre… vdb-entry

Affected products

yookassa

=<2.16.1

Dismissed

(no matching packages found)

Permalink CVE-2026-64810

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible …

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

IntelliJ IDEA

<2026.2

Dismissed

(no matching packages found)

Permalink CVE-2026-65512

5.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 1 month, 1 week ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 1 week ago

WordPress WP Activity Log plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in WP Activity Log <= 5.6.4 versions.

References

https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerab… vdb-entry

Affected products

wp-security-audit-log

=<5.6.4

Dismissed suggestions

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products