Nixpkgs security tracker

Dismissed

(no matching packages found)

Permalink CVE-2026-50748

9.9 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month, 4 weeks ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 4 weeks ago

A malicious actor with access to the network and low …

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

References

https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-4…

Affected products

UniFi Access Application

<4.2.29

Dismissed

(no matching packages found)

Permalink CVE-2025-69155

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 1 month, 4 weeks ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 4 weeks ago

WordPress Fitness Zone WordPress Theme theme <= 5.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.

References

https://patchstack.com/database/wordpress/theme/fitnesszone/vulnerability/wordp… vdb-entry

Affected products

Fitness Zone WordPress Theme

=<5.7

Dismissed

(no matching packages found)

Permalink CVE-2026-11965

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 month, 4 weeks ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 4 weeks ago

User Registration & Membership < 5.2.0 - Unauthenticated Paid Membership Bypass

The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership subscription, allowing unauthenticated users (after self-registering an account through the open registration flow) to obtain an active subscription on any paid plan without paying and access the gated content.

References

https://wpscan.com/vulnerability/49f4c59e-5931-405d-8518-244531bbc889/ exploitvdb-entrytechnical-description

Affected products

User Registration & Membership

<5.2.0

Dismissed

(no matching packages found)

Permalink CVE-2026-57765

8.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 1 month, 4 weeks ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 4 weeks ago

WordPress WP EasyCart plugin <= 5.9.0 - SQL Injection vulnerability

Contributor SQL Injection in WP EasyCart <= 5.9.0 versions.

References

https://patchstack.com/database/wordpress/plugin/wp-easycart/vulnerability/word… vdb-entry

Affected products

WP EasyCart

=<5.9.0

Dismissed

(no matching packages found)

Permalink CVE-2026-57277

8.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month, 4 weeks ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 4 weeks ago

GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. The Websocket server can accept various commands coming from localhost. One of them, `connectionInfo` is meant to provide the necessary details to connect to a camera. The handler associated with this command that we call`handle_connection_info` contains multiple instances of string copy that can overflow. The function `handle_connect_info` copies attacker-controlled JSON strings into fixed-size buffers using manual byte-by-byte loops that do not enforce length limits. #### Buffer Overflow in key field

References

https://www.geovision.com.tw/cyber_security.php vendor-advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2026-2375 third-party-advisory

Affected products

GeoWebPlayer

==V1.1.3.0
==V1.1.1.0

Dismissed

(no matching packages found)

Permalink CVE-2026-54403

8.6 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month, 4 weeks ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 4 weeks ago

A malicious actor with access to the network could exploit …

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.

References

https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-4…

Affected products

Express 7

<5.1.19

Cloud Keys

<5.1.19

Dream Wall

<5.1.19

Dream Routers

<5.1.19

Cloud Gateways

<5.1.19

Dream Machines

<5.1.19

UniFi OS Server

<5.1.19

Network Video Recorders

<5.1.19

Enterprise Firewall Core

<5.1.19

Network Attached Storage

<5.1.19

Enterprise Video Recorders

<5.1.19

Enterprise Fortress Gateway

<5.1.19

Dismissed

(no matching packages found)

Permalink CVE-2026-57683

9.3 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 1 month, 4 weeks ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 4 weeks ago

WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.

References

https://patchstack.com/database/wordpress/plugin/fulltext-search/vulnerability/… vdb-entry

Affected products

WP Fast Total Search

=<1.80.280

Dismissed

(no matching packages found)

Permalink CVE-2026-57355

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 1 month, 4 weeks ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 4 weeks ago

WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

References

https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerabili… vdb-entry

Affected products

Classified Listing

=<5.4.2

Dismissed

(exclusively hosted service)

Permalink CVE-2026-45499

9.9 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month, 4 weeks ago Activity log

Created & dismissed (exclusively hosted service) suggestion 1 month, 4 weeks ago

Azure OpenAI Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.

References

Azure OpenAI Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Azure Open AI

==-

Dismissed

(no matching packages found)

Permalink CVE-2026-27426

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

created 1 month, 4 weeks ago Activity log

Created & dismissed (no matching packages found) suggestion 1 month, 4 weeks ago

WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.

References

https://patchstack.com/database/wordpress/theme/automotive/vulnerability/wordpr… vdb-entry

Affected products

Automotive Car Dealership Business

=<13.3.3

Dismissed suggestions

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products