Nixpkgs security tracker

Dismissed

(no matching packages found)

Permalink CVE-2026-56164

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Exploit Code Maturity (E): Functional (F)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 3 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 3 hours ago

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

References

Microsoft SharePoint Server Elevation of Privilege Vulnerability patchvendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026… government-resource

Affected products

Microsoft SharePoint Server 2019

<16.0.10417.20175

Microsoft SharePoint Enterprise Server 2016

<16.0.5561.1001

Microsoft SharePoint Server Subscription Edition

<16.0.19725.20434

Dismissed

(max. allowed matches exceeded)

Permalink CVE-2026-15058

created 3 hours ago Activity log

Created & dismissed (max. allowed matches exceeded) suggestion 3 hours ago

Improper authorization in the secure messages deletion endpoint in Devolutions …

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.

References

https://devolutions.net/security/advisories/DEVO-2026-0024/

Affected products

Server

<2026.2.12
<2026.1.23

Dismissed

(no matching packages found)

Permalink CVE-2026-58545

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 3 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 3 hours ago

Windows Kernel Security Feature Bypass Vulnerability

Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.

References

Windows Kernel Security Feature Bypass Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26226

Windows Server 2016

<10.0.14393.9339

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows Server 2012 R2

<6.3.9600.23291

Windows 10 Version 1607

<10.0.14393.9339

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26100.8875

Windows 11 version 26H1

<10.0.28000.2525

Windows Server 2012 (Server Core installation)

<6.2.9200.26226

Windows Server 2016 (Server Core installation)

<10.0.14393.9339

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23291

Dismissed

(no matching packages found)

Permalink CVE-2026-62643

7.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 3 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 3 hours ago

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient …

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.

References

Affected products

Webmail

<1.6.17
<1.7.2

Dismissed

(no matching packages found)

Permalink CVE-2026-50451

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 3 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 3 hours ago

Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

References

Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26226

Windows Server 2016

<10.0.14393.9339

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows Server 2012 R2

<6.3.9600.23291

Windows 10 Version 1607

<10.0.14393.9339

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26200.8875

Windows 11 version 26H1

<10.0.28000.2269

Windows Server 2012 (Server Core installation)

<6.2.9200.26226

Windows Server 2016 (Server Core installation)

<10.0.14393.9339

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23291

Dismissed

(no matching packages found)

Permalink CVE-2026-50449

7.0 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 3 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 3 hours ago

Windows Runtime Elevation of Privilege Vulnerability

Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.

References

Windows Runtime Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26200.8875

Windows 11 version 26H1

<10.0.28000.2269

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Dismissed

(no matching packages found)

Permalink CVE-2026-50678

6.6 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

created 3 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 3 hours ago

Microsoft Excel Information Disclosure Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

References

Microsoft Excel Information Disclosure Vulnerability patchvendor-advisory

Affected products

Microsoft Excel 2016

<16.0.5561.1001

Office Online Server

<16.0.10417.20175

Microsoft Office 2019

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2021

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2024

<https://aka.ms/OfficeSecurityReleases

Microsoft Office 365 for Mac

<16.111.26071215

Microsoft 365 Apps for Enterprise

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC for Mac 2021

<16.111.26071215

Microsoft Office LTSC for Mac 2024

<16.111.26071215

Dismissed

(no matching packages found)

Permalink CVE-2026-49459

6.1 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 3 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 3 hours ago

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.

References

https://github.com/cure53/DOMPurify/security/advisories/GHSA-r47g-fvhr-h676 x_refsource_CONFIRM
https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae x_refsource_MISC
https://github.com/cure53/DOMPurify/releases/tag/3.4.6 x_refsource_MISC

Affected products

DOMPurify

==< 3.4.6

Dismissed

(no matching packages found)

Permalink CVE-2026-50318

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 3 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 3 hours ago

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

References

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Windows Server 2016

<10.0.14393.9339

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows 10 Version 1607

<10.0.14393.9339

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26200.8875

Windows 11 version 26H1

<10.0.28000.2525

Windows Server 2016 (Server Core installation)

<10.0.14393.9339

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Dismissed

(no matching packages found)

Permalink CVE-2026-50462

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 3 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 3 hours ago

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

References

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26226

Windows Server 2016

<10.0.14393.9339

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows Server 2012 R2

<6.3.9600.23291

Windows 10 Version 1607

<10.0.14393.9339

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26200.8875

Windows 11 version 26H1

<10.0.28000.2269

Windows Server 2012 (Server Core installation)

<6.2.9200.26226

Windows Server 2016 (Server Core installation)

<10.0.14393.9339

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23291

Dismissed suggestions

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products