Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2026-29612
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding

OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pressure and denial of service.

Affected products

OpenClaw
  • <2026.2.14

Matching in nixpkgs

pkgs.openclaw

Self-hosted, open-source AI assistant/agent

Package maintainers

Permalink CVE-2026-27383
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
WordPress Metro theme <= 2.13 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through <= 2.13.

Affected products

metro
  • =<<= 2.13

Matching in nixpkgs

pkgs.gmetronome

Free software metronome and tempo measurement tool

Package maintainers

Permalink CVE-2026-27375
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
WordPress Gecko theme <= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JanStudio Gecko gecko allows Reflected XSS.This issue affects Gecko: from n/a through <= 1.9.8.

Affected products

gecko
  • =<<= 1.9.8

Matching in nixpkgs

pkgs.geckodriver

Proxy for using W3C WebDriver-compatible clients to interact with Gecko-based browsers

Package maintainers

Permalink CVE-2026-22420
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
WordPress Horizon theme <= 1.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Horizon horizon allows PHP Local File Inclusion.This issue affects Horizon: from n/a through <= 1.1.

Affected products

horizon
  • =<<= 1.1

Matching in nixpkgs

pkgs.horizon-eda

Free EDA software to develop printed circuit boards

Package maintainers

Permalink CVE-2026-28395
4.8 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl

OpenClaw version 2026.1.14-1 prior to 2026.2.12 contain an improper network binding vulnerability in the Chrome extension (must be installed and enabled) relay server that treats wildcard hosts as loopback addresses, allowing the relay HTTP/WS server to bind to all interfaces when a wildcard cdpUrl is configured. Remote attackers can access relay HTTP endpoints off-host to leak service presence and port information, or conduct denial-of-service and brute-force attacks against the relay token header.

Affected products

OpenClaw
  • <2026.2.12

Matching in nixpkgs

pkgs.openclaw

Self-hosted, open-source AI assistant/agent

Package maintainers

Permalink CVE-2026-29081
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
Frappe: Possibility of SQL Injection due to improper fieldname sanitization

Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and 15.100.0.

Affected products

frappe
  • ==< 15.100.0
  • ==< 14.100.1

Matching in nixpkgs

Permalink CVE-2026-28394
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool

OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory exhaustion by parsing oversized or deeply nested HTML responses. Remote attackers can social-engineer users into fetching malicious URLs with pathological HTML structures to exhaust server memory and cause service unavailability.

Affected products

OpenClaw
  • <2026.2.15

Matching in nixpkgs

pkgs.openclaw

Self-hosted, open-source AI assistant/agent

Package maintainers

Permalink CVE-2026-27982
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
An open redirect vulnerability exists in django-allauth versions prior to …

An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.

Affected products

django-allauth
  • ==prior to 65.14.1

Matching in nixpkgs

pkgs.python312Packages.django-allauth

Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication

pkgs.python314Packages.django-allauth

Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication

Package maintainers

Permalink CVE-2026-28076
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
WordPress Guff theme <= 1.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Frenify Guff guff allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Guff: from n/a through <= 1.0.1.

Affected products

guff
  • =<<= 1.0.1

Matching in nixpkgs

Permalink CVE-2026-28047
8.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
WordPress Victo theme <= 1.4.16 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Victo victo allows PHP Local File Inclusion.This issue affects Victo: from n/a through <= 1.4.16.

Affected products

victo
  • =<<= 1.4.16

Matching in nixpkgs

pkgs.vmagent

fast, cost-effective and scalable time series database, long-term remote storage for Prometheus

pkgs.victor-mono

Free programming font with cursive italics and ligatures

pkgs.victoriatraces

Fast open-source observability solution for distributed traces

Package maintainers