Nixpkgs security tracker

Dismissed

(no matching packages found)

Permalink CVE-2026-69552

5.7 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 week, 4 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 4 days ago

Windows Print Spooler Components Information Disclosure Vulnerability

Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.

References

Windows Print Spooler Components Information Disclosure Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26349

Windows Server 2016

<10.0.14393.9512

Windows Server 2019

<10.0.17763.9245

Windows Server 2022

<10.0.20348.5622

Windows Server 2025

<10.0.26100.33438

Windows Server 2012 R2

<6.3.9600.23397

Windows 10 Version 1607

<10.0.14393.9512

Windows 10 Version 1809

<10.0.17763.9245

Windows 10 Version 21H2

<10.0.19044.7725

Windows 10 Version 22H2

<10.0.19045.7725

Windows 11 Version 23H2

<10.0.22631.7582

Windows 11 Version 24H2

<10.0.26100.9445

Windows 11 Version 25H2

<10.0.26200.9445

Windows 11 version 23H2

<10.0.22631.7582

Windows 11 version 26H1

<10.0.28000.2954

Windows Server 2012 (Server Core installation)

<6.2.9200.26349

Windows Server 2016 (Server Core installation)

<10.0.14393.9512

Windows Server 2019 (Server Core installation)

<10.0.17763.9245

Windows Server 2025 (Server Core installation)

<10.0.26100.33438

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23397

Dismissed

(no matching packages found)

Permalink CVE-2026-69404

7.0 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 week, 4 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 4 days ago

Windows TCP/IP Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

References

Windows TCP/IP Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26349

Windows Server 2016

<10.0.14393.9512

Windows Server 2019

<10.0.17763.9245

Windows Server 2022

<10.0.20348.5622

Windows Server 2025

<10.0.26100.33438

Windows Server 2012 R2

<6.3.9600.23397

Windows 10 Version 1607

<10.0.14393.9512

Windows 10 Version 1809

<10.0.17763.9245

Windows 10 Version 21H2

<10.0.19044.7725

Windows 10 Version 22H2

<10.0.19045.7725

Windows 11 Version 23H2

<10.0.22631.7582

Windows 11 Version 24H2

<10.0.26100.9445

Windows 11 Version 25H2

<10.0.26200.9445

Windows 11 version 23H2

<10.0.22631.7582

Windows 11 version 26H1

<10.0.28000.2954

Windows Server 2012 (Server Core installation)

<6.2.9200.26349

Windows Server 2016 (Server Core installation)

<10.0.14393.9512

Windows Server 2019 (Server Core installation)

<10.0.17763.9245

Windows Server 2025 (Server Core installation)

<10.0.26100.33438

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23397

Dismissed

(no matching packages found)

Permalink CVE-2026-69270

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 week, 4 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 4 days ago

Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

References

Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26349

Windows Server 2016

<10.0.14393.9512

Windows Server 2019

<10.0.17763.9245

Windows Server 2022

<10.0.20348.5622

Windows Server 2025

<10.0.26100.33438

Windows Server 2012 R2

<6.3.9600.23397

Windows 10 Version 1607

<10.0.14393.9512

Windows 10 Version 1809

<10.0.17763.9245

Windows 10 Version 21H2

<10.0.19044.7725

Windows 10 Version 22H2

<10.0.19045.7725

Windows 11 Version 23H2

<10.0.22631.7582

Windows 11 Version 24H2

<10.0.26100.9445

Windows 11 Version 25H2

<10.0.26200.9445

Windows 11 version 23H2

<10.0.22631.7582

Windows 11 version 26H1

<10.0.28000.2954

Windows Server 2012 (Server Core installation)

<6.2.9200.26349

Windows Server 2016 (Server Core installation)

<10.0.14393.9512

Windows Server 2019 (Server Core installation)

<10.0.17763.9245

Windows Server 2025 (Server Core installation)

<10.0.26100.33438

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23397

Dismissed

(no matching packages found)

Permalink CVE-2026-71376

9.8 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 week, 4 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 4 days ago

OS Command Injection Vulnerability in Cosminexus Component Container

OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

References

https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-202… vendor-advisory

Affected products

Cosminexus Component Container

<11-70-03
<09-87-10
<11-60-03
=<11-10-11
<11-00-13
<09-80-05
=<09-50-22
=<09-00-18
=<11-30-08
<11-20-10
=<11-50-03
=<11-40-03
<09-70-28

Dismissed

(no matching packages found)

Permalink CVE-2026-69672

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 week, 4 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 4 days ago

Windows DNS Information Disclosure Vulnerability

Use of uninitialized resource in Windows DNS allows an authorized attacker to disclose information locally.

References

Windows DNS Information Disclosure Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26349

Windows Server 2016

<10.0.14393.9512

Windows Server 2019

<10.0.17763.9245

Windows Server 2022

<10.0.20348.5622

Windows Server 2025

<10.0.26100.33438

Windows Server 2012 R2

<6.3.9600.23397

Windows 10 Version 1607

<10.0.14393.9512

Windows 10 Version 1809

<10.0.17763.9245

Windows Server 2012 (Server Core installation)

<6.2.9200.26349

Windows Server 2016 (Server Core installation)

<10.0.14393.9512

Windows Server 2019 (Server Core installation)

<10.0.17763.9245

Windows Server 2025 (Server Core installation)

<10.0.26100.33438

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23397

Dismissed

(no matching packages found)

Permalink CVE-2026-86518

2.1 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): POC (P)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 1 week, 4 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 4 days ago

code-projects Student Crud Operation edit.php sql injection

A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References

VDB-399672 | code-projects Student Crud Operation edit.php sql injection vdb-entrytechnical-description
VDB-399672 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
CVE-2026-86518 | CVE Analysis and Report third-party-advisory
Submit #908878 | code-projects Student Crud Operation In PHP 1.0 SQL Injection third-party-advisory
https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Student%20CRUD%20Operatio… exploit
https://code-projects.org/ product

Affected products

Student Crud Operation

==1.0

Dismissed

(no matching packages found)

Permalink CVE-2026-75691

5.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 1 week, 4 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 4 days ago

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

References

https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html vendor-advisory

Affected products

Adobe Experience Manager 6.5

==6.5.25
=<6.5.24

Adobe Experience Manager 6.5 LTS

=<SP2
==SP3

Adobe Experience Manager as a Cloud Service

=<2026.7.0
==2026.8.0

Dismissed

(no matching packages found)

Permalink CVE-2026-78522

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 week, 4 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 4 days ago

Microsoft Office Word Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

References

Microsoft Office Word Information Disclosure Vulnerability patchvendor-advisory

Affected products

Microsoft Word 2016

<16.0.5569.1000

Microsoft Office 2019

<16.0.10417.20207

Microsoft Office LTSC 2021

<16.0.14334.20906

Microsoft Office LTSC 2024

<16.0.17932.20976

Microsoft 365 Apps for Enterprise

<16.0.20326.20138

Dismissed

(no matching packages found)

Permalink CVE-2026-69440

7.0 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 week, 4 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 4 days ago

Windows MIDI Service Module Elevation of Privileges Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

References

Windows MIDI Service Module Elevation of Privileges Vulnerability patchvendor-advisory

Affected products

Windows 11 Version 24H2

<10.0.26100.9445

Windows 11 Version 25H2

<10.0.26200.9445

Windows 11 version 26H1

<10.0.28000.2954

Dismissed

(no matching packages found)

Permalink CVE-2026-78513

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 week, 4 days ago Activity log

Created & dismissed (no matching packages found) suggestion 1 week, 4 days ago

Microsoft Office PowerPoint Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

References

Microsoft Office PowerPoint Information Disclosure Vulnerability patchvendor-advisory

Affected products

Microsoft Office 2019

<16.0.10417.20207

Microsoft PowerPoint 2016

<16.0.5569.1002

Microsoft Office LTSC 2021

<16.0.14334.20906

Microsoft Office LTSC 2024

<16.0.17932.20976

Microsoft Office 365 for Mac

==-

Microsoft 365 Apps for Enterprise

<16.0.20326.20138

Microsoft Office LTSC for Mac 2021

<16.112.26083020

Microsoft Office LTSC for Mac 2024

<16.112.26083020

Dismissed suggestions

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products