Nixpkgs security tracker

Dismissed

(no matching packages found)

Permalink CVE-2026-41585

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): High (H)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 day, 12 hours ago by @ADMIN Activity log

Created suggestion 4 months ago
@ADMIN dismissed (no matching packages found) 1 day, 12 hours ago

ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients

ZEBRA is a Zcash node written entirely in Rust. From zebrad versions 2.2.0 to before 4.3.1 and from zebra-rpc versions 1.0.0-beta.45 to before 6.0.2, a vulnerability in Zebra's JSON-RPC HTTP middleware allows an authenticated RPC client to cause a Zebra node to crash by disconnecting before the request body is fully received. The node treats the failure to read the HTTP request body as an unrecoverable error and aborts the process instead of returning an error response. This issue has been patched in zebrad version 4.3.1 and zebra-rpc version 6.0.2.

References

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-29x4-r6jv-ff4w x_refsource_CONFIRM

Affected products

zebra

==zebrad >= 2.2.0, < 4.3.1
==zebra-rpc >= 1.0.0-beta.45, < 6.0.2

Dismissed

(exclusively hosted service)

Permalink CVE-2026-42826

10.0 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 4 months, 1 week ago Activity log

Created & dismissed (exclusively hosted service) suggestion 4 months, 1 week ago

Azure DevOps Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.

References

Azure DevOps Information Disclosure Vulnerability patchvendor-advisory

Affected products

Azure DevOps

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-32207

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 4 months, 1 week ago Activity log

Created & dismissed (exclusively hosted service) suggestion 4 months, 1 week ago

Azure Machine Learning Notebook Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.

References

Azure Machine Learning Notebook Spoofing Vulnerability patchvendor-advisory

Affected products

Azure Machine Learning

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-26164

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 4 months, 1 week ago Activity log

Created & dismissed (exclusively hosted service) suggestion 4 months, 1 week ago

M365 Copilot Information Disclosure Vulnerability

Improper neutralization of special elements in output used by a downstream component ('injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

References

M365 Copilot Information Disclosure Vulnerability patchvendor-advisory

Affected products

Microsoft 365 Copilot's Business Chat

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-26129

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 4 months, 1 week ago Activity log

Created & dismissed (exclusively hosted service) suggestion 4 months, 1 week ago

M365 Copilot Information Disclosure Vulnerability

Improper neutralization of special elements in M365 Copilot allows an unauthorized attacker to disclose information over a network.

References

M365 Copilot Information Disclosure Vulnerability patchvendor-advisory

Affected products

Microsoft 365 Copilot's Business Chat

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-35428

9.6 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 4 months, 1 week ago Activity log

Created & dismissed (exclusively hosted service) suggestion 4 months, 1 week ago

Azure Cloud Shell Spoofing Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network.

References

Azure Cloud Shell Spoofing Vulnerability patchvendor-advisory

Affected products

Azure Cloud Shell

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-34327

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): Low (L)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 4 months, 1 week ago Activity log

Created & dismissed (exclusively hosted service) suggestion 4 months, 1 week ago

Microsoft Partner Center Spoofing Vulnerability

Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network.

References

Microsoft Partner Center Spoofing Vulnerability patchvendor-advisory

Affected products

Microsoft Partner Center

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-33823

9.6 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 4 months, 1 week ago Activity log

Created & dismissed (exclusively hosted service) suggestion 4 months, 1 week ago

Microsoft Team Events Portal Information Disclosure Vulnerability

Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.

References

Microsoft Team Events Portal Information Disclosure Vulnerability patchvendor-advisory

Affected products

Microsoft Teams

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-33844

9.0 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 4 months, 1 week ago Activity log

Created & dismissed (exclusively hosted service) suggestion 4 months, 1 week ago

Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

Improper input validation in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

References

Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability vendor-advisorypatch

Affected products

Azure Managed Instance for Apache Cassandra

==-

Dismissed

(exclusively hosted service)

Permalink CVE-2026-41105

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 4 months, 1 week ago Activity log

Created & dismissed (exclusively hosted service) suggestion 4 months, 1 week ago

Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.

References

Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Azure Monitor Action Group notification system

==-

Dismissed suggestions

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products