Nixpkgs security tracker

Dismissed

(no matching packages found)

Permalink CVE-2026-48561

9.6 CRITICAL

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 21 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 21 hours ago

Microsoft Copilot Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to execute code over a network.

References

Microsoft Copilot Remote Code Execution Vulnerability patchvendor-advisory

Affected products

Microsoft 365 Copilot for iOS

<publication

Microsoft 365 Copilot for Android

<publication

Dismissed

(no matching packages found)

Permalink CVE-2026-58530

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 21 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 21 hours ago

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.

References

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability patchvendor-advisory

Affected products

Windows Server 2016

<10.0.14393.9339

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows 10 Version 1607

<10.0.14393.9339

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26100.8875

Windows 11 version 26H1

<10.0.28000.2525

Windows Server 2016 (Server Core installation)

<10.0.14393.9339

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Dismissed

(no matching packages found)

Permalink CVE-2026-15752

5.5 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): POC (P)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 21 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 21 hours ago

zhinianboke xianyu-auto-reply Backend User Endpoint users authorization

A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/users/ of the component Backend User Endpoint. Performing a manipulation results in missing authorization. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 19fc3282a1bb78a05c34945c088525d20e081cbd. Applying a patch is the recommended action to fix this issue.

References

VDB-378334 | zhinianboke xianyu-auto-reply Backend User Endpoint users authorization vdb-entry
VDB-378334 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
CVE-2026-15752 | CVE Analysis and Report third-party-advisory
Submit #856716 | zhinianboke xianyu-auto-reply main branch at or before commit 04580d6490b4731d0055f29736930d8cc59b60d6 CWE-862 Missing Authorization third-party-advisory
https://github.com/zhinianboke/xianyu-auto-reply/issues/192 issue-trackingexploit
https://github.com/zhinianboke/xianyu-auto-reply/commit/19fc3282a1bb78a05c34945… patch
https://github.com/zhinianboke/xianyu-auto-reply/ product

Affected products

xianyu-auto-reply

==dcb445ad97816ad65299a7580ee0c8c8f929da84

Dismissed

(no matching packages found)

Permalink CVE-2026-55139

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 21 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 21 hours ago

Microsoft Office Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

References

Microsoft Office Information Disclosure Vulnerability patchvendor-advisory

Affected products

Microsoft Office 2016

<16.0.5561.1000

Microsoft Office 2019

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2021

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2024

<https://aka.ms/OfficeSecurityReleases

Microsoft Office 365 for Mac

<16.111.26071215

Microsoft 365 Apps for Enterprise

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC for Mac 2021

<16.111.26071215

Microsoft Office LTSC for Mac 2024

<16.111.26071215

Dismissed

(no matching packages found)

Permalink CVE-2026-50339

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 21 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 21 hours ago

Windows Push Notification Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.

References

Windows Push Notification Information Disclosure Vulnerability patchvendor-advisory

Affected products

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26200.8875

Windows 11 version 26H1

<10.0.28000.2269

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Dismissed

(no matching packages found)

Permalink CVE-2026-47470

6.2 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 21 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 21 hours ago

NVIDIA TensorRT-LLM for any platform contains a vulnerability in the …

NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by local attack. A successful exploit of this vulnerability might lead to denial of service.

References

Affected products

TensorRT-LLM

=<v1.3.0 rc14

Dismissed

(no matching packages found)

Permalink CVE-2026-15625

2.1 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): POC (P)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

created 21 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 21 hours ago

nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist

A vulnerability was found in nextlevelbuilder GoClaw 3.11.3. Affected by this issue is the function ExecApprovalManager.CheckCommand of the file internal/tools/exec_approval.go. The manipulation results in incomplete blacklist. The attack can be executed remotely. The exploit has been made public and could be used.

References

VDB-378127 | nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist vdb-entrytechnical-description
VDB-378127 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
CVE-2026-15625 | CVE Analysis and Report third-party-advisory
Submit #855804 | nextlevelbuilder GoClaw 3.11.3 Command Execution Policy Bypass (CWE-184) third-party-advisory
Submit #855806 | nextlevelbuilder GoClaw 3.13.2 Command Execution Policy Bypass (CWE-184) (Duplicate) third-party-advisory
Submit #855807 | nextlevelbuilder GoClaw 3.13.3-beta.3 Authorization Bypass (CWE-863) (Duplicate) third-party-advisory
Submit #855845 | nextlevelbuilder GoClaw 3.13.3-beta.3 Command Execution Policy Bypass (CWE-184) (Duplicate) third-party-advisory
Submit #855846 | nextlevelbuilder GoClaw 3.13.2 Improper Authorization (CWE-285) (Duplicate) third-party-advisory
Submit #855848 | nextlevelbuilder GoClaw 3.13.2 OS Command Injection (CWE-78) (Duplicate) third-party-advisory
https://github.com/nextlevelbuilder/goclaw/issues/1200 issue-trackingexploit
https://github.com/nextlevelbuilder/goclaw/issues/1200#issuecomment-4760771866 issue-tracking
https://github.com/nextlevelbuilder/goclaw/ product

Affected products

GoClaw

==3.11.3

Dismissed

(no matching packages found)

Permalink CVE-2026-52100

created 21 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 21 hours ago

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through …

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function

References

Affected products

n/a

==n/a

Dismissed

(no matching packages found)

Permalink CVE-2026-47296

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 21 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 21 hours ago

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

References

Microsoft SQL Server Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Microsoft SQL Server 2017 (GDR)

<14.0.2120.1

Microsoft SQL Server 2019 (GDR)

<15.0.2180.2

Microsoft SQL Server 2022 (GDR)

<16.0.1190.2

Microsoft SQL Server 2025 (CU 6)

<17.0.4060.2

Microsoft SQL Server 2017 (CU 31)

<14.0.3540.1

Microsoft SQL Server 2019 (CU 32)

<15.0.4480.2

Microsoft SQL Server 2016 Service Pack 3 (GDR)

<13.0.6500.1

Microsoft SQL Server 2025 for x64-based Systems (GDR)

<17.0.1125.2

Microsoft SQL Server 2022 for x64-based Systems (CU 25)

<16.0.4262.2

Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack

<13.0.7095.1

Dismissed

(no matching packages found)

Permalink CVE-2026-50346

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 21 hours ago Activity log

Created & dismissed (no matching packages found) suggestion 21 hours ago

Netlogon RPC Elevation of Privilege Vulnerability

Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally.

References

Netlogon RPC Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26226

Windows Server 2016

<10.0.14393.9339

Windows Server 2019

<10.0.17763.9020

Windows Server 2022

<10.0.20348.5386

Windows Server 2025

<10.0.26100.33158

Windows Server 2012 R2

<6.3.9600.23291

Windows 10 Version 1607

<10.0.14393.9339

Windows 10 Version 1809

<10.0.17763.9020

Windows 10 Version 21H2

<10.0.19044.7548

Windows 10 Version 22H2

<10.0.19045.7548

Windows 11 Version 24H2

<10.0.26100.8875

Windows 11 Version 25H2

<10.0.26200.8875

Windows 11 version 26H1

<10.0.28000.2269

Windows Server 2012 (Server Core installation)

<6.2.9200.26226

Windows Server 2016 (Server Core installation)

<10.0.14393.9339

Windows Server 2019 (Server Core installation)

<10.0.17763.9020

Windows Server 2025 (Server Core installation)

<10.0.26100.33158

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23291

Dismissed suggestions

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products