Nixpkgs security tracker

Dismissed

(exclusively hosted service)

Permalink CVE-2026-26138

8.6 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 5 months, 1 week ago Activity log

Created suggestion 5 months, 1 week ago

Microsoft Purview Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.

References

Microsoft Purview Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Microsoft Purview

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-32169

10.0 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 5 months, 1 week ago Activity log

Created suggestion 5 months, 1 week ago

Azure Cloud Shell Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network.

References

Azure Cloud Shell Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Azure Cloud Shell

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-23651

6.7 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 5 months, 3 weeks ago Activity log

Created suggestion 5 months, 3 weeks ago

Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability

Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

References

Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Microsoft ACI Confidential Containers

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-26124

6.7 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 5 months, 3 weeks ago Activity log

Created suggestion 5 months, 3 weeks ago

Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability

References

Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability vendor-advisorypatch

Affected products

Microsoft ACI Confidential Containers

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-26125

8.6 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 5 months, 3 weeks ago Activity log

Created suggestion 5 months, 3 weeks ago

Payment Orchestrator Service Elevation of Privilege Vulnerability

References

Payment Orchestrator Service Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Payment Orchestrator Service

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-21536

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 5 months, 3 weeks ago Activity log

Created suggestion 5 months, 3 weeks ago

Microsoft Devices Pricing Program Remote Code Execution Vulnerability

References

Microsoft Devices Pricing Program Remote Code Execution Vulnerability patchvendor-advisory

Affected products

Microsoft Devices Pricing Program

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-26122

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 5 months, 3 weeks ago Activity log

Created suggestion 5 months, 3 weeks ago

Microsoft ACI Confidential Containers Information Disclosure Vulnerability

References

Microsoft ACI Confidential Containers Information Disclosure Vulnerability patchvendor-advisory

Affected products

Microsoft ACI Confidential Containers

==-

Permalink CVE-2025-47379

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 5 months, 3 weeks ago by @Erethon Activity log

Created suggestion 5 months, 3 weeks ago
@Erethon dismissed 5 months, 3 weeks ago
@Erethon accepted 5 months, 3 weeks ago
@Erethon dismissed 5 months, 3 weeks ago

Use After Free in Automotive Audio

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.

References

https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-b…

Affected products

Snapdragon

==QCA6698AQ
==QCA8695AU
==SA8295P
==Snapdragon 7s Gen 3 Mobile Platform
==SRV1M
==WCD9375
==QCA9377
==QCN6224
==Snapdragon 8 Gen 2 Mobile Platform
==SRV1H
==SA8155
==QCA6174A
==QEP8111
==QCN9012
==SA8150P
==SM7325P
==SA8145P
==Snapdragon 8 Gen 3 Mobile Platform
==AR8031
==QCA2066
==Snapdragon 782G Mobile Platform
==Snapdragon X12 LTE Modem
==Snapdragon Auto 5G Modem-RF
==WCN3950
==WCN6755
==Flight RB5 5G Platform
==QAM8255P
==SM8650Q
==WCD9340
==WSA8835
==Milos
==Snapdragon X35 5G Modem-RF System
==Snapdragon 460 Mobile Platform
==QRB5165M
==SM8550P
==Snapdragon 888+ 5G Mobile Platform
==QCN9011
==WCD9335
==QCA6584AU
==Snapdragon 660 Mobile Platform
==SM8635P
==SD865 5G
==QFW7114
==WCN3660B
==QRB5165N
==G1 Gen 1
==QCA6391
==Snapdragon 662 Mobile Platform
==Qualcomm 215 Mobile Platform
==Snapdragon XR2+ Gen 1 Platform
==Snapdragon W5+ Gen 1 Wearable Platform
==QCA8337
==SA6155P
==QCA6698AU
==SM7675P
==5G Fixed Wireless Access Platform
==WCD9370
==WCD9390
==QCA6574A
==SA4150P
==WCN3910
==SA2150P
==QCA6564A
==FastConnect 7800
==SM7675
==FWA Gen 3 Ultra Platform
==SM7550P
==Snapdragon 778G 5G Mobile Platform
==Snapdragon 870 5G Mobile Platform
==WSA8840
==Snapdragon X55 5G Modem-RF System
==QCA6574
==QCM5430
==QCM6490
==AR8035
==FastConnect 6700
==WCD9378
==WCN3988
==LeMans_AU_LGIT
==SA9000P
==QCA6797AQ
==QCC710
==QCN6274
==CSRA6640
==Snapdragon 888 5G Mobile Platform
==QCA8081
==QCA6678AQ
==SA7775P
==SM7550
==WCD9326
==Snapdragon 865 5G Mobile Platform
==WSA8832
==SnapdragonAuto 4GModem
==Robotics RB2 Platform
==Snapdragon 685 4G Mobile Platform
==FastConnect 6900
==Snapdragon 7c+ Gen 3 Compute
==FastConnect 6800
==Robotics RB5 Platform
==SA8155P
==QCA9367
==SM6650P
==QCA6574AU
==WSA8830
==Snapdragon 695 5G Mobile Platform
==QCA6688AQ
==Smart Audio 400 Platform
==Snapdragon X53 5G Modem-RF System
==WCD9371
==WCD9395
==Snapdragon Auto 5G Modem-RF Gen 2
==Qualcomm Video Collaboration VC5 Platform
==Snapdragon X72 5G Modem-RF System
==SD662
==LeMansAU
==WCD9380
==WSA8810
==WCN3990
==SA8770P
==QCS2290
==Snapdragon 6 Gen 4 Mobile Platform
==CSRA6620
==QCS4290
==WCN6650
==SA4155P
==QCA6595
==SW5100P
==Snapdragon X75 5G Modem-RF System
==SA8255P
==QCA6564
==Snapdragon 4 Gen 1 Mobile Platform
==SW5100
==Snapdragon 690 5G Mobile Platform
==WSA8845H
==Snapdragon 8+ Gen 2 Mobile Platform
==QCM4325
==QFW7124
==SM8635
==QCS8550
==QCA6564AU
==SA8195P
==WCD9341
==Snapdragon X32 5G Modem-RF System
==QAMSRV1H
==WSA8845
==C-V2X 9150
==QCM6125
==Qualcomm Video Collaboration VC3 Platform
==Snapdragon 778G+ 5G Mobile Platform
==SA8620P
==WCN3680B
==QCA6696
==WCD9360
==SA6145P
==WSA8815
==QCA6595AU
==QAMSRV1M
==QAM8295P
==SA6155
==WCD9385
==FastConnect 6200
==WCN3980
==Snapdragon 480+ 5G Mobile Platform
==SA6150P
==QCM2290
==MDM9250
==SM6225P
==Snapdragon 865+ 5G Mobile Platform
==MDM9628
==SA7255P
==WCN3615
==Snapdragon 480 5G Mobile Platform
==SM7635P
==WCN6450
==Snapdragon 680 4G Mobile Platform
==Snapdragon XR2 5G Platform
==Qualcomm Video Collaboration VC1 Platform
==SDA660

Matching in nixpkgs

pkgs.snapdragon-profiler

An profiler for Android devices running Snapdragon chips

nixos-unstable -
- nixos-unstable-small 2021.2

Testing suggestion edit
Testing round #2
Test round #3

Dismissed

(exclusively hosted service)

Permalink CVE-2026-26365

4.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 5 months, 3 weeks ago by @ADMIN Activity log

Created suggestion 6 months ago
@ADMIN dismissed 5 months, 3 weeks ago

Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles …

Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling.