Nixpkgs security tracker

Try the new UI
Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Dismissed suggestions

These automatic suggestions were dismissed after initial triaging.

to select a suggestion for revision.

View:
Compact
Detailed
Dismissed
(no matching packages found)
Permalink CVE-2026-67389
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 1 week, 5 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 week, 5 days ago
Microsoft SQL Server Information Disclosure Vulnerability

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

Affected products

Microsoft SQL Server 2022 (GDR)
  • <16.0.1200.5
Microsoft SQL Server 2025 (CU8)
  • <17.0.4085.5
Microsoft SQL Server 2022 (CU 26)
  • <16.0.4275.2
Microsoft SQL Server 2025 for x64-based Systems (GDR)
  • <17.0.1135.8
Dismissed
(no matching packages found)
Permalink CVE-2026-62706
8.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 5 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 week, 5 days ago
Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

Affected products

Windows Server 2012
  • <6.2.9200.26349
Windows Server 2016
  • <10.0.14393.9512
Windows Server 2019
  • <10.0.17763.9245
Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows Server 2012 R2
  • <6.3.9600.23397
Windows 10 Version 1607
  • <10.0.14393.9512
Windows 10 Version 1809
  • <10.0.17763.9245
Windows 10 Version 21H2
  • <10.0.19044.7725
Windows 10 Version 22H2
  • <10.0.19045.7725
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2012 (Server Core installation)
  • <6.2.9200.26349
Windows Server 2016 (Server Core installation)
  • <10.0.14393.9512
Windows Server 2019 (Server Core installation)
  • <10.0.17763.9245
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Windows Server 2012 R2 (Server Core installation)
  • <6.3.9600.23397
Dismissed
(no matching packages found)
Permalink CVE-2026-69500
7.0 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 5 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 week, 5 days ago
Windows Image Acquisition Elevation of Privilege Vulnerability

Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.

Affected products

Windows Server 2012
  • <6.2.9200.26349
Windows Server 2016
  • <10.0.14393.9512
Windows Server 2019
  • <10.0.17763.9245
Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows Server 2012 R2
  • <6.3.9600.23397
Windows 10 Version 1607
  • <10.0.14393.9512
Windows 10 Version 1809
  • <10.0.17763.9245
Windows 10 Version 21H2
  • <10.0.19044.7725
Windows 10 Version 22H2
  • <10.0.19045.7725
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2012 (Server Core installation)
  • <6.2.9200.26349
Windows Server 2016 (Server Core installation)
  • <10.0.14393.9512
Windows Server 2019 (Server Core installation)
  • <10.0.17763.9245
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Windows Server 2012 R2 (Server Core installation)
  • <6.3.9600.23397
Dismissed
(no matching packages found)
Permalink CVE-2026-69339
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 1 week, 5 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 week, 5 days ago
Windows MIDI Service Module Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally.

Affected products

Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 26H1
  • <10.0.28000.2954
Dismissed
(no matching packages found)
Permalink CVE-2026-68842
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 1 week, 5 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 week, 5 days ago
Windows MIDI Service Module Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally.

Affected products

Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 26H1
  • <10.0.28000.2954
Dismissed
(no matching packages found)
Permalink CVE-2026-69599
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 5 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 week, 5 days ago
Remote Desktop Services Remote Code Execution Vulnerability

Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.

Affected products

Windows Server 2025
  • <10.0.26100.33438
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Dismissed
(no matching packages found)
Permalink CVE-2026-69280
7.0 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 5 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 week, 5 days ago
Windows Push Notifications Elevation of Privilege Vulnerability

Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Affected products

Windows Server 2016
  • <10.0.14393.9512
Windows Server 2019
  • <10.0.17763.9245
Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows 10 Version 1607
  • <10.0.14393.9512
Windows 10 Version 1809
  • <10.0.17763.9245
Windows 10 Version 21H2
  • <10.0.19044.7725
Windows 10 Version 22H2
  • <10.0.19045.7725
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2016 (Server Core installation)
  • <10.0.14393.9512
Windows Server 2019 (Server Core installation)
  • <10.0.17763.9245
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Dismissed
(no matching packages found)
Permalink CVE-2026-69595
9.8 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 5 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 week, 5 days ago
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.

Affected products

Windows Server 2012
  • <6.2.9200.26349
Windows Server 2016
  • <10.0.14393.9512
Windows Server 2019
  • <10.0.17763.9245
Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows Server 2012 R2
  • <6.3.9600.23397
Windows Server 2012 (Server Core installation)
  • <6.2.9200.26349
Windows Server 2016 (Server Core installation)
  • <10.0.14393.9512
Windows Server 2019 (Server Core installation)
  • <10.0.17763.9245
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Windows Server 2012 R2 (Server Core installation)
  • <6.3.9600.23397
Dismissed
(no matching packages found)
Permalink CVE-2026-69689
8.0 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 5 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 week, 5 days ago
Windows Win32k Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges over a network.

References

Affected products

Windows Server 2019
  • <10.0.17763.9245
Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows 10 Version 1809
  • <10.0.17763.9245
Windows 10 Version 21H2
  • <10.0.19044.7725
Windows 10 Version 22H2
  • <10.0.19045.7725
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2019 (Server Core installation)
  • <10.0.17763.9245
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Dismissed
(no matching packages found)
Permalink CVE-2026-69475
7.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 5 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 week, 5 days ago
Windows Remote Desktop Services Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

Affected products

Windows Server 2012
  • <6.2.9200.26349
Windows Server 2016
  • <10.0.14393.9512
Windows Server 2019
  • <10.0.17763.9245
Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows Server 2012 R2
  • <6.3.9600.23397
Windows 10 Version 1607
  • <10.0.14393.9512
Windows 10 Version 1809
  • <10.0.17763.9245
Windows 10 Version 21H2
  • <10.0.19044.7725
Windows 10 Version 22H2
  • <10.0.19045.7725
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2012 (Server Core installation)
  • <6.2.9200.26349
Windows Server 2016 (Server Core installation)
  • <10.0.14393.9512
Windows Server 2019 (Server Core installation)
  • <10.0.17763.9245
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Windows Server 2012 R2 (Server Core installation)
  • <6.3.9600.23397