Nixpkgs security tracker

Try the new UI
Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Dismissed suggestions

These automatic suggestions were dismissed after initial triaging.

to select a suggestion for revision.

View:
Compact
Detailed
Dismissed
(no matching packages found)
Permalink CVE-2026-81806
7.2 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
created 1 week, 4 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion
WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.

Affected products

hide-my-wp
  • =<7.0.09
Dismissed
(no matching packages found)
Permalink CVE-2026-79910
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 1 week, 4 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion
Acrobat Reader | Out-of-bounds Read (CWE-125)

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected products

Acrobat 2024
  • =<24.001.30383
  • ==24.001.30429
Adobe Acrobat
  • =<26.002.21900
  • ==26.002.21901
Acrobat Reader
  • =<26.002.21900
  • ==26.002.21901
Dismissed
(no matching packages found)
Permalink CVE-2026-69604
7.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 4 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion
Windows Audio Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Audio Service allows an authorized attacker to elevate privileges locally.

Affected products

Windows Server 2012
  • <6.2.9200.26349
Windows Server 2016
  • <10.0.14393.9512
Windows Server 2019
  • <10.0.17763.9245
Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows Server 2012 R2
  • <6.3.9600.23397
Windows 10 Version 1607
  • <10.0.14393.9512
Windows 10 Version 1809
  • <10.0.17763.9245
Windows 10 Version 21H2
  • <10.0.19044.7725
Windows 10 Version 22H2
  • <10.0.19045.7725
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2012 (Server Core installation)
  • <6.2.9200.26349
Windows Server 2016 (Server Core installation)
  • <10.0.14393.9512
Windows Server 2019 (Server Core installation)
  • <10.0.17763.9245
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Windows Server 2012 R2 (Server Core installation)
  • <6.3.9600.23397
Dismissed
(no matching packages found)
Permalink CVE-2026-69398
7.0 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 4 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion
Windows Bluetooth Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

Affected products

Windows Server 2019
  • <10.0.17763.9245
Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows 10 Version 1809
  • <10.0.17763.9245
Windows 10 Version 21H2
  • <10.0.19044.7725
Windows 10 Version 22H2
  • <10.0.19045.7725
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2019 (Server Core installation)
  • <10.0.17763.9245
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Dismissed
(max. allowed matches exceeded)
created 1 week, 4 days ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass …

In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Android
  • ==16
  • ==16-qpr2
  • ==14
  • ==15
Dismissed
(max. allowed matches exceeded)
created 1 week, 4 days ago Activity log
  • Created & dismissed (max. allowed matches exceeded) suggestion
In serviceClassExists of InCallController.java, there is a possible arbitrary code …

In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Android
  • ==17
Dismissed
(no matching packages found)
Permalink CVE-2026-69468
7.0 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 4 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion
Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.

Affected products

Windows Server 2012
  • <6.2.9200.26349
Windows Server 2016
  • <10.0.14393.9512
Windows Server 2019
  • <10.0.17763.9245
Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows Server 2012 R2
  • <6.3.9600.23397
Windows 10 Version 1607
  • <10.0.14393.9512
Windows 10 Version 1809
  • <10.0.17763.9245
Windows 10 Version 21H2
  • <10.0.19044.7725
Windows 10 Version 22H2
  • <10.0.19045.7725
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2012 (Server Core installation)
  • <6.2.9200.26349
Windows Server 2016 (Server Core installation)
  • <10.0.14393.9512
Windows Server 2019 (Server Core installation)
  • <10.0.17763.9245
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Windows Server 2012 R2 (Server Core installation)
  • <6.3.9600.23397
Dismissed
(no matching packages found)
Permalink CVE-2026-69310
7.0 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 4 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion
Windows DNS Elevation of Privilege Vulnerability

Use after free in Windows DNS allows an authorized attacker to elevate privileges locally.

References

Affected products

Windows Server 2016
  • <10.0.14393.9512
Windows Server 2019
  • <10.0.17763.9245
Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows Server 2012 R2
  • <6.3.9600.23397
Windows 10 Version 1607
  • <10.0.14393.9512
Windows 10 Version 1809
  • <10.0.17763.9245
Windows 10 Version 21H2
  • <10.0.19044.7725
Windows 10 Version 22H2
  • <10.0.19045.7725
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2016 (Server Core installation)
  • <10.0.14393.9512
Windows Server 2019 (Server Core installation)
  • <10.0.17763.9245
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Windows Server 2012 R2 (Server Core installation)
  • <6.3.9600.23397
Dismissed
(no matching packages found)
Permalink CVE-2026-69350
6.7 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 4 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion
Windows Overlay Filter Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

Affected products

Windows Server 2016
  • <10.0.14393.9512
Windows Server 2019
  • <10.0.17763.9245
Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows Server 2012 R2
  • <6.3.9600.23397
Windows 10 Version 1607
  • <10.0.14393.9512
Windows 10 Version 1809
  • <10.0.17763.9245
Windows 10 Version 21H2
  • <10.0.19044.7725
Windows 10 Version 22H2
  • <10.0.19045.7725
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2016 (Server Core installation)
  • <10.0.14393.9512
Windows Server 2019 (Server Core installation)
  • <10.0.17763.9245
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438
Windows Server 2012 R2 (Server Core installation)
  • <6.3.9600.23397
Dismissed
(no matching packages found)
Permalink CVE-2026-83990
7.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Exploit Code Maturity (E): Unproven (U)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 week, 4 days ago Activity log
  • Created & dismissed (no matching packages found) suggestion
Microsoft Graphics Component Elevation of Privilege Vulnerability

Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Affected products

Windows Server 2022
  • <10.0.20348.5622
Windows Server 2025
  • <10.0.26100.33438
Windows 11 Version 23H2
  • <10.0.22631.7582
Windows 11 Version 24H2
  • <10.0.26100.9445
Windows 11 Version 25H2
  • <10.0.26200.9445
Windows 11 version 23H2
  • <10.0.22631.7582
Windows 11 version 26H1
  • <10.0.28000.2954
Windows Server 2025 (Server Core installation)
  • <10.0.26100.33438