Nixpkgs security tracker

Dismissed

(no matching packages found)

Permalink CVE-2026-66810

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 3 weeks, 6 days ago Activity log

Created & dismissed (no matching packages found) suggestion 3 weeks, 6 days ago

Microsoft Office Word Information Disclosure Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

References

Microsoft Office Word Information Disclosure Vulnerability patchvendor-advisory

Affected products

Microsoft Word 2016

<16.0.5565.1000

Microsoft Office 2019

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2021

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2024

<https://aka.ms/OfficeSecurityReleases

Microsoft Office 365 for Mac

<16.112.26081010

Microsoft 365 Apps for Enterprise

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC for Mac 2021

<16.112.26081010

Microsoft Office LTSC for Mac 2024

<16.112.26081010

Dismissed

(no matching packages found)

Permalink CVE-2026-67568

9.3 CRITICAL

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 3 weeks, 6 days ago Activity log

Created & dismissed (no matching packages found) suggestion 3 weeks, 6 days ago

Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.

References

Affected products

Mira Firmware

==1.7.1.47

Mira Android App

==4.5.15.4

Dismissed

(no matching packages found)

Permalink CVE-2026-62818

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 3 weeks, 6 days ago Activity log

Created & dismissed (no matching packages found) suggestion 3 weeks, 6 days ago

Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability

Use after free in Active Directory Certificate Services (AD CS) allows an authorized attacker to execute code over a network.

References

Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability patchvendor-advisory

Affected products

Windows Server 2012

<6.2.9200.26280

Windows Server 2016

<10.0.14393.9418

Windows Server 2019

<10.0.17763.9115

Windows Server 2022

<10.0.20348.5499

Windows Server 2025

<10.0.26100.33296

Windows Server 2012 R2

<6.3.9600.23338

Windows 10 Version 1607

<10.0.14393.9418

Windows 10 Version 1809

<10.0.17763.9115

Windows Server 2012 (Server Core installation)

<6.2.9200.26280

Windows Server 2016 (Server Core installation)

<10.0.14393.9418

Windows Server 2019 (Server Core installation)

<10.0.17763.9115

Windows Server 2025 (Server Core installation)

<10.0.26100.33296

Windows Server 2012 R2 (Server Core installation)

<6.3.9600.23338

Dismissed

(exclusively hosted service)

Permalink CVE-2026-63522

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 3 weeks, 6 days ago Activity log

Created & dismissed (exclusively hosted service) suggestion 3 weeks, 6 days ago

Azure SQL Database Elevation of Privilege Vulnerability

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally.

References

Azure SQL Database Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Azure SQL Database

==-

Dismissed

(no matching packages found)

Permalink CVE-2026-58639

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 3 weeks, 6 days ago Activity log

Created & dismissed (no matching packages found) suggestion 3 weeks, 6 days ago

Microsoft SharePoint Server Spoofing Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

References

Microsoft SharePoint Server Spoofing Vulnerability patchvendor-advisory

Affected products

Microsoft SharePoint Server 2019

<16.0.10417.20198

Microsoft SharePoint Enterprise Server 2016

<16.0.5565.1001

Microsoft SharePoint Server Subscription Edition

<16.0.19725.20522

Dismissed

(no matching packages found)

Permalink CVE-2020-37263

created 3 weeks, 6 days ago Activity log

Created & dismissed (no matching packages found) suggestion 3 weeks, 6 days ago

None

Affected products

Dismissed

(no matching packages found)

Permalink CVE-2026-65672

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 3 weeks, 6 days ago Activity log

Created & dismissed (no matching packages found) suggestion 3 weeks, 6 days ago

Remote Access API Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally.

References

Remote Access API Elevation of Privilege Vulnerability patchvendor-advisory

Affected products

Windows Server 2022

<10.0.20348.5499

Windows Server 2025

<10.0.26100.33296

Windows 11 Version 23H2

<10.0.22631.7517

Windows 11 Version 24H2

<10.0.26100.9168

Windows 11 Version 25H2

<10.0.26200.9168

Windows 11 version 23H2

<10.0.22631.7517

Windows 11 version 26H1

<10.0.28000.2704

Windows Server 2025 (Server Core installation)

<10.0.26100.33296

Dismissed

(no matching packages found)

Permalink CVE-2026-61361

7.0 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 3 weeks, 6 days ago Activity log

Created & dismissed (no matching packages found) suggestion 3 weeks, 6 days ago

Windows DHCP Client Remote Code Execution Vulnerability

Use after free in Windows DHCP Client allows an authorized attacker to execute code locally.

References

Windows DHCP Client Remote Code Execution Vulnerability patchvendor-advisory

Affected products

Windows Server 2025

<10.0.26100.33296

Windows 11 Version 24H2

<10.0.26100.9168

Windows 11 Version 25H2

<10.0.26200.9168

Windows 11 version 26H1

<10.0.28000.2704

Windows Server 2025 (Server Core installation)

<10.0.26100.33296

Dismissed

(no matching packages found)

Permalink CVE-2026-19434

5.1 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 3 weeks, 6 days ago Activity log

Created & dismissed (no matching packages found) suggestion 3 weeks, 6 days ago

Stored Cross-site Scripting in Pentestify finding severity field

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.

References

https://github.com/ccyl13/Pentestify/commit/8e81053d490f0ba188543b7de3e5edf8711… patch
https://github.com/ccyl13/Pentestify/releases/tag/v2.3.2 release-notes
https://secur0.com/en/cna/cve-list/cve-2026-19434-stored-xss-in-pentestify-find… technical-description

Affected products

Pentestify

<2.3.1

Dismissed

(no matching packages found)

Permalink CVE-2026-66807

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Exploit Code Maturity (E): Unproven (U)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 3 weeks, 6 days ago Activity log

Created & dismissed (no matching packages found) suggestion 3 weeks, 6 days ago

Microsoft Office Graphics Component Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

References

Microsoft Office Graphics Component Remote Code Execution Vulnerability patchvendor-advisory

Affected products

Microsoft Office 2019

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2021

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2024

<https://aka.ms/OfficeSecurityReleases

Microsoft Office 365 for Mac

<16.112.26081010

Microsoft 365 Apps for Enterprise

<https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC for Mac 2021

<16.112.26081010

Microsoft Office LTSC for Mac 2024

<16.112.26081010

Dismissed suggestions

References

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products

Affected products

References

Affected products

References

Affected products

References

Affected products

References

Affected products