Nixpkgs security tracker

Permalink CVE-2026-63140

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

Reachable Assertion in Elasticsearch Leading to Denial of Service

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully stops Elasticsearch; in a multi-node cluster it reduces cluster capacity for each affected node.

References

https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-…

Affected products

Elasticsearch

=<8.19.18
=<9.3.7
=<9.4.3

Matching in nixpkgs

pkgs.elasticsearch

Open Source, Distributed, RESTful Search Engine

nixos-unstable 7.17.27
- nixpkgs-unstable 7.17.27
- nixos-unstable-small 7.17.27
nixos-26.05 7.17.27
- nixos-26.05-small 7.17.27
- nixpkgs-26.05-darwin 7.17.27

pkgs.elasticsearch7

Open Source, Distributed, RESTful Search Engine

nixos-unstable 7.17.27
- nixpkgs-unstable 7.17.27
- nixos-unstable-small 7.17.27
nixos-26.05 7.17.27
- nixos-26.05-small 7.17.27
- nixpkgs-26.05-darwin 7.17.27

pkgs.elasticsearch-curator

Curate, or manage, your Elasticsearch indices and snapshots

nixos-unstable 8.0.21
- nixpkgs-unstable 8.0.21
- nixos-unstable-small 8.0.21
nixos-26.05 8.0.21
- nixos-26.05-small 8.0.21
- nixpkgs-26.05-darwin 8.0.21

pkgs.gitlab-elasticsearch-indexer

Indexes Git repositories into Elasticsearch for GitLab

nixos-unstable 5.14.7
- nixpkgs-unstable 5.14.7
- nixos-unstable-small 5.14.7
nixos-26.05 5.14.7
- nixos-26.05-small 5.14.7
- nixpkgs-26.05-darwin 5.14.7

pkgs.python313Packages.elasticsearch

Official low-level client for Elasticsearch

nixos-unstable 8.18.1
- nixpkgs-unstable 8.18.1
- nixos-unstable-small 8.18.1
nixos-26.05 8.18.1
- nixos-26.05-small 8.18.1
- nixpkgs-26.05-darwin 8.18.1

pkgs.python314Packages.elasticsearch

Official low-level client for Elasticsearch

nixos-unstable 8.18.1
- nixpkgs-unstable 8.18.1
- nixos-unstable-small 8.18.1
nixos-26.05 8.18.1
- nixos-26.05-small 8.18.1
- nixpkgs-26.05-darwin 8.18.1

pkgs.python313Packages.elasticsearch8

Official low-level client for Elasticsearch

nixos-unstable 8.19.3
- nixpkgs-unstable 8.19.3
- nixos-unstable-small 8.19.3
nixos-26.05 8.19.3
- nixos-26.05-small 8.19.3
- nixpkgs-26.05-darwin 8.19.3

pkgs.python314Packages.elasticsearch8

Official low-level client for Elasticsearch

nixos-unstable 8.19.3
- nixpkgs-unstable 8.19.3
- nixos-unstable-small 8.19.3
nixos-26.05 8.19.3
- nixos-26.05-small 8.19.3
- nixpkgs-26.05-darwin 8.19.3

pkgs.elasticsearchPlugins.analysis-icu

ICU Analysis plugin integrates the Lucene ICU module into elasticsearch

nixos-unstable 7.17.27
- nixpkgs-unstable 7.17.27
- nixos-unstable-small 7.17.27
nixos-26.05 7.17.27
- nixos-26.05-small 7.17.27
- nixpkgs-26.05-darwin 7.17.27

pkgs.elasticsearchPlugins.search-guard

Elasticsearch plugin that offers encryption, authentication, and authorisation

nixos-unstable 7.17.27-53.10.0
- nixpkgs-unstable 7.17.27-53.10.0
- nixos-unstable-small 7.17.27-53.10.0
nixos-26.05 7.17.27-53.10.0
- nixos-26.05-small 7.17.27-53.10.0
- nixpkgs-26.05-darwin 7.17.27-53.10.0

pkgs.haskellPackages.log-elasticsearch

Structured logging solution (Elasticsearch back end)

nixos-unstable 0.13.0.2
- nixpkgs-unstable 0.13.0.2
- nixos-unstable-small 0.13.0.2
nixos-26.05 0.13.0.2
- nixos-26.05-small 0.13.0.2
- nixpkgs-26.05-darwin 0.13.0.2

pkgs.prometheus-elasticsearch-exporter

Elasticsearch stats exporter for Prometheus

nixos-unstable 1.10.0
- nixpkgs-unstable 1.10.0
- nixos-unstable-small 1.10.0
nixos-26.05 1.10.0
- nixos-26.05-small 1.10.0
- nixpkgs-26.05-darwin 1.10.0

pkgs.terraform-providers.elasticsearch

None

nixos-unstable 2.0.7
- nixpkgs-unstable 2.0.7
nixos-26.05 2.0.7
- nixos-26.05-small 2.0.7
- nixpkgs-26.05-darwin 2.0.7

pkgs.elasticsearchPlugins.discovery-ec2

EC2 discovery plugin uses the AWS API for unicast discovery

nixos-unstable 7.17.27
- nixpkgs-unstable 7.17.27
- nixos-unstable-small 7.17.27
nixos-26.05 7.17.27
- nixos-26.05-small 7.17.27
- nixpkgs-26.05-darwin 7.17.27

pkgs.elasticsearchPlugins.repository-s3

S3 repository plugin adds support for using AWS S3 as a repository for Snapshot/Restore

nixos-unstable 7.17.27
- nixpkgs-unstable 7.17.27
- nixos-unstable-small 7.17.27
nixos-26.05 7.17.27
- nixos-26.05-small 7.17.27
- nixpkgs-26.05-darwin 7.17.27

pkgs.python313Packages.elasticsearchdsl

High level Python client for Elasticsearch

nixos-unstable 8.18.0
- nixpkgs-unstable 8.18.0
- nixos-unstable-small 8.18.0
nixos-26.05 8.18.0
- nixos-26.05-small 8.18.0
- nixpkgs-26.05-darwin 8.18.0

pkgs.python314Packages.elasticsearchdsl

High level Python client for Elasticsearch

nixos-unstable 8.18.0
- nixpkgs-unstable 8.18.0
- nixos-unstable-small 8.18.0
nixos-26.05 8.18.0
- nixos-26.05-small 8.18.0
- nixpkgs-26.05-darwin 8.18.0

pkgs.elasticsearchPlugins.repository-gcs

GCS repository plugin adds support for using Google Cloud Storage as a repository for Snapshot/Restore

nixos-unstable 7.17.27
- nixpkgs-unstable 7.17.27
- nixos-unstable-small 7.17.27
nixos-26.05 7.17.27
- nixos-26.05-small 7.17.27
- nixpkgs-26.05-darwin 7.17.27

pkgs.python313Packages.elasticsearch-dsl

High level Python client for Elasticsearch

nixos-unstable 8.18.0
- nixpkgs-unstable 8.18.0
- nixos-unstable-small 8.18.0
nixos-26.05 8.18.0
- nixos-26.05-small 8.18.0
- nixpkgs-26.05-darwin 8.18.0

pkgs.python314Packages.elasticsearch-dsl

High level Python client for Elasticsearch

nixos-unstable 8.18.0
- nixpkgs-unstable 8.18.0
- nixos-unstable-small 8.18.0
nixos-26.05 8.18.0
- nixos-26.05-small 8.18.0
- nixpkgs-26.05-darwin 8.18.0

pkgs.elasticsearchPlugins.analysis-smartcn

Smart Chinese Analysis plugin integrates Lucene Smart Chinese analysis module into Elasticsearch

nixos-unstable 7.17.27
- nixpkgs-unstable 7.17.27
- nixos-unstable-small 7.17.27
nixos-26.05 7.17.27
- nixos-26.05-small 7.17.27
- nixpkgs-26.05-darwin 7.17.27

pkgs.elasticsearchPlugins.analysis-kuromoji

Japanese (kuromoji) Analysis plugin integrates Lucene kuromoji analysis module into Elasticsearch

nixos-unstable 7.17.27
- nixpkgs-unstable 7.17.27
- nixos-unstable-small 7.17.27
nixos-26.05 7.17.27
- nixos-26.05-small 7.17.27
- nixpkgs-26.05-darwin 7.17.27

pkgs.elasticsearchPlugins.analysis-phonetic

Phonetic Analysis plugin integrates phonetic token filter analysis with elasticsearch

nixos-unstable 7.17.27
- nixpkgs-unstable 7.17.27
- nixos-unstable-small 7.17.27
nixos-26.05 7.17.27
- nixos-26.05-small 7.17.27
- nixpkgs-26.05-darwin 7.17.27

pkgs.elasticsearchPlugins.ingest-attachment

Ingest processor that uses Apache Tika to extract contents

nixos-unstable 7.17.27
- nixpkgs-unstable 7.17.27
- nixos-unstable-small 7.17.27
nixos-26.05 7.17.27
- nixos-26.05-small 7.17.27
- nixpkgs-26.05-darwin 7.17.27

pkgs.haskellPackages.amazonka-elasticsearch

Amazon Elasticsearch Service SDK

nixos-unstable 2.0-unstable-2025-04-16
- nixpkgs-unstable 2.0-unstable-2025-04-16
- nixos-unstable-small 2.0-unstable-2025-04-16
nixos-26.05 2.0-unstable-2025-04-16
- nixos-26.05-small 2.0-unstable-2025-04-16
- nixpkgs-26.05-darwin 2.0-unstable-2025-04-16

pkgs.python313Packages.django-elasticsearch-dsl

Wrapper around elasticsearch-dsl-py for Django models

nixos-unstable 8.0
- nixpkgs-unstable 8.0
- nixos-unstable-small 8.0
nixos-26.05 8.0
- nixos-26.05-small 8.0
- nixpkgs-26.05-darwin 8.0

pkgs.python314Packages.django-elasticsearch-dsl

Wrapper around elasticsearch-dsl-py for Django models

nixos-unstable 8.0
- nixpkgs-unstable 8.0
- nixos-unstable-small 8.0
nixos-26.05 8.0
- nixos-26.05-small 8.0
- nixpkgs-26.05-darwin 8.0

pkgs.terraform-providers.phillbaker_elasticsearch

None

nixos-unstable 2.0.7
- nixpkgs-unstable 2.0.7
- nixos-unstable-small 2.0.7
nixos-26.05 2.0.7
- nixos-26.05-small 2.0.7
- nixpkgs-26.05-darwin 2.0.7

pkgs.python313Packages.pysigma-backend-elasticsearch

Library to support Elasticsearch for pySigma

nixos-unstable 2.0.3
- nixpkgs-unstable 2.1.0
- nixos-unstable-small 2.1.0
nixos-26.05 2.0.3
- nixos-26.05-small 2.0.3
- nixpkgs-26.05-darwin 2.0.3

pkgs.python314Packages.pysigma-backend-elasticsearch

Library to support Elasticsearch for pySigma

nixos-unstable 2.0.3
- nixpkgs-unstable 2.1.0
- nixos-unstable-small 2.1.0
nixos-26.05 2.0.3
- nixos-26.05-small 2.0.3
- nixpkgs-26.05-darwin 2.0.3

pkgs.python313Packages.aliyun-python-sdk-elasticsearch

Module of Aliyun Python SDK (elasticsearch)

nixos-unstable -
- nixpkgs-unstable 3.1.2
- nixos-unstable-small 3.1.2

pkgs.python314Packages.aliyun-python-sdk-elasticsearch

Module of Aliyun Python SDK (elasticsearch)

nixos-unstable -
- nixpkgs-unstable 3.1.2
- nixos-unstable-small 3.1.2

Package maintainers

@basvandijk Bas van Dijk <v.dijk.bas@gmail.com>
@yayayayaka Yaya <github@uwu.is>
@e1mo Nina Fromm <nixpkgs@e1mo.de>
@xanderio Alexander Sieg <alex@xanderio.de>
@de11n Elliot Cameron <nixpkgs-commits@deshaw.com>
@despsyched Priyanshu Tripathi <priyanshu.tripathi@deshaw.com>
@onny Jonas Heinrich <onny@project-insanity.org>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>

Permalink CVE-2026-16363

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

JIT miscompilation in the JavaScript: WebAssembly component

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13.

References

Affected products

Firefox

=<140.*
=<*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

nixos-unstable -
- nixos-unstable-small 2.85.9
nixos-26.05 -
- nixos-26.05-small 2.85.5

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivates

nixos-unstable -
- nixos-unstable-small 1.1.3
nixos-26.05 -
- nixos-26.05-small 1.1.3

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.0
nixos-26.05 -
- nixos-26.05-small 152.0.6

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.0
nixos-26.05 -
- nixos-26.05-small 152.0.6

pkgs.firefox-gnome-theme

GNOME theme for Firefox

nixos-unstable -
- nixos-unstable-small 150
nixos-26.05 -
- nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

nixos-unstable -
- nixos-unstable-small 1.10.0
nixos-26.05 -
- nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.18.4
nixos-26.05 -
- nixos-26.05-small 2.18.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

nixos-unstable -
- nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.18.4
nixos-26.05 -
- nixos-26.05-small 2.18.2

pkgs.firefox-esr-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 140.13.0esr
nixos-26.05 -
- nixos-26.05-small 140.12.0esr

pkgs.pkgsRocm.firefox-beta

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.pkgsRocm.firefox-mobile

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.0
nixos-26.05 -
- nixos-26.05-small 152.0.6

pkgs.firefox-esr-140-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 140.13.0esr
nixos-26.05 -
- nixos-26.05-small 140.12.0esr

pkgs.firefox-esr-153-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.0esr

pkgs.pkgsRocm.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.0
nixos-26.05 -
- nixos-26.05-small 152.0.6

pkgs.pkgsRocm.firefox-devedition

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.pkgsRocm.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

nixos-unstable -
- nixos-unstable-small 7
nixos-26.05 -
- nixos-26.05-small 7

pkgs.pkgsRocm.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

nixos-unstable -
- nixos-unstable-small 4
nixos-26.05 -
- nixos-26.05-small 4

pkgs.gnomeExtensions.pip-alwaysontop-for-firefox

Enable Picture-in-Picture(PIP) mode to always be on for Firefox in Gnome.

nixos-unstable -
- nixos-unstable-small 1
nixos-26.05 -
- nixos-26.05-small 1

pkgs.vscode-extensions.firefox-devtools.vscode-firefox-debug

Visual Studio Code extension for debugging web applications and browser extensions in Firefox

nixos-unstable -
- nixos-unstable-small 2.15.0
nixos-26.05 -
- nixos-26.05-small 2.15.0

Package maintainers

@magnetophon Bart Brouns <bart@magnetophon.nl>
@pmahoney Patrick Mahoney <pat@polycrystal.org>
@jopejoe1 jopejoe1 <nixpkgs@missing.ninja>
@rhendric Ryan Hendrickson
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
@nekowinston winston <hey@winston.sh>
@ambroisie Bruno BELANYI <bruno.nixpkgs@belanyi.fr>
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
@schnusch schnusch
@unode Renato Alves <alves.rjc@gmail.com>
@pasqui23 pasqui23 <p3dimaria@hotmail.it>
@camillemndn Camille M. <camillemondon@free.fr>
@honnip Jung seungwoo <me@honnip.page>
@felschr Felix Schröter <dev@felschr.com>
@philiptaron Philip Taron <philip.taron@gmail.com>

Permalink CVE-2026-59848

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

Libssh: libssh: denial of service via sftp responses with unknown request ids

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

References

https://access.redhat.com/security/cve/CVE-2026-59848 vdb-entryx_refsource_REDHAT
RHBZ#2498181 x_refsource_REDHATissue-tracking

Affected products

libssh

Matching in nixpkgs

pkgs.libssh

SSH client library

nixos-unstable 0.12.0
- nixpkgs-unstable 0.12.0
- nixos-unstable-small 0.12.0
nixos-26.05 0.12.0
- nixos-26.05-small 0.12.0
- nixpkgs-26.05-darwin 0.12.0

pkgs.libssh2

Client-side C library implementing the SSH2 protocol

nixos-unstable 1.11.1
- nixpkgs-unstable 1.11.1
- nixos-unstable-small 1.11.1
nixos-26.05 1.11.1
- nixos-26.05-small 1.11.1
- nixpkgs-26.05-darwin 1.11.1

pkgs.libsshWithGssapi

SSH client library

nixos-unstable -
- nixos-unstable-small 0.12.0

pkgs.haskellPackages.libssh

libssh bindings

nixos-unstable 0.1.0.0
- nixpkgs-unstable 0.1.0.0
- nixos-unstable-small 0.1.0.0
nixos-26.05 0.1.0.0
- nixos-26.05-small 0.1.0.0
- nixpkgs-26.05-darwin 0.1.0.0

pkgs.haskellPackages.libssh2

FFI bindings to libssh2 SSH2 client library (http://libssh2.org/)

nixos-unstable 0.2.0.9-unstable-2025-04-03
- nixpkgs-unstable 0.2.0.9-unstable-2025-04-03
- nixos-unstable-small 0.2.0.9-unstable-2025-04-03
nixos-26.05 0.2.0.9-unstable-2025-04-03
- nixos-26.05-small 0.2.0.9-unstable-2025-04-03
- nixpkgs-26.05-darwin 0.2.0.9-unstable-2025-04-03

pkgs.haskellPackages.libssh2-conduit

Conduit wrappers for libssh2 FFI bindings (see libssh2 package)

nixos-unstable 0.2.1
- nixpkgs-unstable 0.2.1
- nixos-unstable-small 0.2.1
nixos-26.05 0.2.1
- nixos-26.05-small 0.2.1
- nixpkgs-26.05-darwin 0.2.1

pkgs.python313Packages.ansible-pylibssh

Python bindings to client functionality of libssh specific to Ansible use case

nixos-unstable 1.4.0
- nixpkgs-unstable 1.4.0
- nixos-unstable-small 1.4.0
nixos-26.05 1.4.0
- nixos-26.05-small 1.4.0
- nixpkgs-26.05-darwin 1.4.0

pkgs.python314Packages.ansible-pylibssh

Python bindings to client functionality of libssh specific to Ansible use case

nixos-unstable 1.4.0
- nixpkgs-unstable 1.4.0
- nixos-unstable-small 1.4.0
nixos-26.05 1.4.0
- nixos-26.05-small 1.4.0
- nixpkgs-26.05-darwin 1.4.0

Package maintainers

@mpscholten Marc Scholten <marc@digitallyinduced.com>
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
@wfdewith Wim de With <wf@dewith.io>

Permalink CVE-2026-56580

2.2 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

HCL MyCloud was affected by Using Components with Known Vulnerability

HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the system.

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132381 vendor-advisory

Affected products

MyCloud

==10.8.2

Matching in nixpkgs

pkgs.deye-dummycloud

A dummy cloud server for DEYE microinverters (Node.js) and bridge to mqtt

nixos-unstable -
- nixos-unstable-small
nixos-26.05 -
- nixos-26.05-small

Package maintainers

@poeschel Lars Pöschel <poeschel@mailbox.org>

Permalink CVE-2026-56578

2.2 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

HCL MyCloud was affected by Server Version Disclosure

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions.

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132381 vendor-advisory

Affected products

MyCloud

==10.8.2

Matching in nixpkgs

pkgs.deye-dummycloud

A dummy cloud server for DEYE microinverters (Node.js) and bridge to mqtt

nixos-unstable -
- nixos-unstable-small
nixos-26.05 -
- nixos-26.05-small

Package maintainers

@poeschel Lars Pöschel <poeschel@mailbox.org>

Permalink CVE-2026-16371

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

Privilege escalation in the DOM: Navigation component

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13.

References

Affected products

Firefox

=<140.*
=<*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

nixos-unstable -
- nixos-unstable-small 2.85.9
nixos-26.05 -
- nixos-26.05-small 2.85.5

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivates

nixos-unstable -
- nixos-unstable-small 1.1.3
nixos-26.05 -
- nixos-26.05-small 1.1.3

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.0
nixos-26.05 -
- nixos-26.05-small 152.0.6

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.0
nixos-26.05 -
- nixos-26.05-small 152.0.6

pkgs.firefox-gnome-theme

GNOME theme for Firefox

nixos-unstable -
- nixos-unstable-small 150
nixos-26.05 -
- nixos-26.05-small 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

nixos-unstable -
- nixos-unstable-small 1.10.0
nixos-26.05 -
- nixos-26.05-small 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.18.4
nixos-26.05 -
- nixos-26.05-small 2.18.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

nixos-unstable -
- nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable -
- nixos-unstable-small 2.18.4
nixos-26.05 -
- nixos-26.05-small 2.18.2

pkgs.firefox-esr-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 140.13.0esr
nixos-26.05 -
- nixos-26.05-small 140.12.0esr

pkgs.pkgsRocm.firefox-beta

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.pkgsRocm.firefox-mobile

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.0
nixos-26.05 -
- nixos-26.05-small 152.0.6

pkgs.firefox-esr-140-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 140.13.0esr
nixos-26.05 -
- nixos-26.05-small 140.12.0esr

pkgs.firefox-esr-153-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.0esr

pkgs.pkgsRocm.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.0
nixos-26.05 -
- nixos-26.05-small 152.0.6

pkgs.pkgsRocm.firefox-devedition

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.pkgsRocm.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

nixos-unstable -
- nixos-unstable-small 7
nixos-26.05 -
- nixos-26.05-small 7

pkgs.pkgsRocm.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable -
- nixos-unstable-small 153.0b13
nixos-26.05 -
- nixos-26.05-small 153.0b13

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

nixos-unstable -
- nixos-unstable-small 4
nixos-26.05 -
- nixos-26.05-small 4

pkgs.gnomeExtensions.pip-alwaysontop-for-firefox

Enable Picture-in-Picture(PIP) mode to always be on for Firefox in Gnome.

nixos-unstable -
- nixos-unstable-small 1
nixos-26.05 -
- nixos-26.05-small 1

pkgs.vscode-extensions.firefox-devtools.vscode-firefox-debug

Visual Studio Code extension for debugging web applications and browser extensions in Firefox

nixos-unstable -
- nixos-unstable-small 2.15.0
nixos-26.05 -
- nixos-26.05-small 2.15.0

Package maintainers

@magnetophon Bart Brouns <bart@magnetophon.nl>
@pmahoney Patrick Mahoney <pat@polycrystal.org>
@jopejoe1 jopejoe1 <nixpkgs@missing.ninja>
@rhendric Ryan Hendrickson
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
@nekowinston winston <hey@winston.sh>
@ambroisie Bruno BELANYI <bruno.nixpkgs@belanyi.fr>
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
@schnusch schnusch
@unode Renato Alves <alves.rjc@gmail.com>
@pasqui23 pasqui23 <p3dimaria@hotmail.it>
@camillemndn Camille M. <camillemondon@free.fr>
@honnip Jung seungwoo <me@honnip.page>
@felschr Felix Schröter <dev@felschr.com>
@philiptaron Philip Taron <philip.taron@gmail.com>

Permalink CVE-2026-59844

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

Libssh: libssh: denial of service via oversized sftp read length

A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.

References

https://access.redhat.com/security/cve/CVE-2026-59844 vdb-entryx_refsource_REDHAT
RHBZ#2498177 issue-trackingx_refsource_REDHAT

Affected products

libssh

libssh2

Matching in nixpkgs

pkgs.libssh

SSH client library

nixos-unstable 0.12.0
- nixpkgs-unstable 0.12.0
- nixos-unstable-small 0.12.0
nixos-26.05 0.12.0
- nixos-26.05-small 0.12.0
- nixpkgs-26.05-darwin 0.12.0

pkgs.libssh2

Client-side C library implementing the SSH2 protocol

nixos-unstable 1.11.1
- nixpkgs-unstable 1.11.1
- nixos-unstable-small 1.11.1
nixos-26.05 1.11.1
- nixos-26.05-small 1.11.1
- nixpkgs-26.05-darwin 1.11.1

pkgs.libsshWithGssapi

SSH client library

nixos-unstable -
- nixos-unstable-small 0.12.0

pkgs.haskellPackages.libssh

libssh bindings

nixos-unstable 0.1.0.0
- nixpkgs-unstable 0.1.0.0
- nixos-unstable-small 0.1.0.0
nixos-26.05 0.1.0.0
- nixos-26.05-small 0.1.0.0
- nixpkgs-26.05-darwin 0.1.0.0

pkgs.haskellPackages.libssh2

FFI bindings to libssh2 SSH2 client library (http://libssh2.org/)

nixos-unstable 0.2.0.9-unstable-2025-04-03
- nixpkgs-unstable 0.2.0.9-unstable-2025-04-03
- nixos-unstable-small 0.2.0.9-unstable-2025-04-03
nixos-26.05 0.2.0.9-unstable-2025-04-03
- nixos-26.05-small 0.2.0.9-unstable-2025-04-03
- nixpkgs-26.05-darwin 0.2.0.9-unstable-2025-04-03

pkgs.haskellPackages.libssh2-conduit

Conduit wrappers for libssh2 FFI bindings (see libssh2 package)

nixos-unstable 0.2.1
- nixpkgs-unstable 0.2.1
- nixos-unstable-small 0.2.1
nixos-26.05 0.2.1
- nixos-26.05-small 0.2.1
- nixpkgs-26.05-darwin 0.2.1

pkgs.python313Packages.ansible-pylibssh

Python bindings to client functionality of libssh specific to Ansible use case

nixos-unstable 1.4.0
- nixpkgs-unstable 1.4.0
- nixos-unstable-small 1.4.0
nixos-26.05 1.4.0
- nixos-26.05-small 1.4.0
- nixpkgs-26.05-darwin 1.4.0

pkgs.python314Packages.ansible-pylibssh

Python bindings to client functionality of libssh specific to Ansible use case

nixos-unstable 1.4.0
- nixpkgs-unstable 1.4.0
- nixos-unstable-small 1.4.0
nixos-26.05 1.4.0
- nixos-26.05-small 1.4.0
- nixpkgs-26.05-darwin 1.4.0

Package maintainers

@mpscholten Marc Scholten <marc@digitallyinduced.com>
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
@wfdewith Wim de With <wf@dewith.io>

Permalink CVE-2026-16358

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

Site isolation issue in the Graphics: WebRender component

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.

References

Affected products

Firefox

=<140.*
=<*
=<115.*

Matching in nixpkgs

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

nixos-unstable 2.85.5
- nixpkgs-unstable 2.85.9
- nixos-unstable-small 2.85.9
nixos-26.05 2.85.5
- nixos-26.05-small 2.85.5
- nixpkgs-26.05-darwin 2.85.5

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivates

nixos-unstable 1.1.3
- nixpkgs-unstable 1.1.3
- nixos-unstable-small 1.1.3
nixos-26.05 1.1.3
- nixos-26.05-small 1.1.3
- nixpkgs-26.05-darwin 1.1.3

pkgs.pkgsRocm.firefox

Web browser built from Firefox source tree

nixos-unstable 152.0
- nixpkgs-unstable 152.0.4
- nixos-unstable-small 153.0
nixos-26.05 152.0.4
- nixos-26.05-small 152.0.6
- nixpkgs-26.05-darwin 152.0.4

pkgs.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable 152.0
- nixpkgs-unstable 152.0.4
- nixos-unstable-small 153.0
nixos-26.05 152.0.4
- nixos-26.05-small 152.0.6
- nixpkgs-26.05-darwin 152.0.4

pkgs.firefox-gnome-theme

GNOME theme for Firefox

nixos-unstable 150
- nixpkgs-unstable 150
- nixos-unstable-small 150
nixos-26.05 150
- nixos-26.05-small 150
- nixpkgs-26.05-darwin 150

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

nixos-unstable 1.10.0
- nixpkgs-unstable 1.10.0
- nixos-unstable-small 1.10.0
nixos-26.05 1.9.0
- nixos-26.05-small 1.9.0
- nixpkgs-26.05-darwin 1.9.0

pkgs.pkgsRocm.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable 2.18.2
- nixpkgs-unstable 2.18.2
- nixos-unstable-small 2.18.4
nixos-26.05 2.18.2
- nixos-26.05-small 2.18.2
- nixpkgs-26.05-darwin 2.18.2

pkgs.firefox-devtools-mcp

Model Context Protocol server for Firefox DevTools automation

nixos-unstable -
- nixos-unstable-small 0.9.9

pkgs.firefoxpwa-unwrapped

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

nixos-unstable 2.18.2
- nixpkgs-unstable 2.18.2
- nixos-unstable-small 2.18.4
nixos-26.05 2.18.2
- nixos-26.05-small 2.18.2
- nixpkgs-26.05-darwin 2.18.2

pkgs.firefox-esr-unwrapped

Web browser built from Firefox source tree

nixos-unstable 140.12.0esr
- nixpkgs-unstable 140.12.0esr
- nixos-unstable-small 140.13.0esr
nixos-26.05 140.12.0esr
- nixos-26.05-small 140.12.0esr
- nixpkgs-26.05-darwin 140.12.0esr

pkgs.pkgsRocm.firefox-beta

Web browser built from Firefox Beta Release source tree

nixos-unstable 151.0b9
- nixpkgs-unstable 152.0b10
- nixos-unstable-small 153.0b13
nixos-26.05 152.0b10
- nixos-26.05-small 153.0b13
- nixpkgs-26.05-darwin 152.0b10

pkgs.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable 151.0b9
- nixpkgs-unstable 152.0b10
- nixos-unstable-small 153.0b13
nixos-26.05 152.0b10
- nixos-26.05-small 153.0b13
- nixpkgs-26.05-darwin 152.0b10

pkgs.pkgsRocm.firefox-mobile

Web browser built from Firefox source tree

nixos-unstable 152.0
- nixpkgs-unstable 152.0.4
- nixos-unstable-small 153.0
nixos-26.05 152.0.4
- nixos-26.05-small 152.0.6
- nixpkgs-26.05-darwin 152.0.4

pkgs.firefox-esr-140-unwrapped

Web browser built from Firefox source tree

nixos-unstable 140.12.0esr
- nixpkgs-unstable 140.12.0esr
- nixos-unstable-small 140.13.0esr
nixos-26.05 140.12.0esr
- nixos-26.05-small 140.12.0esr
- nixpkgs-26.05-darwin 140.12.0esr

pkgs.firefox-esr-153-unwrapped

Web browser built from Firefox source tree

nixos-unstable -
- nixos-unstable-small 153.0esr

pkgs.pkgsRocm.firefox-unwrapped

Web browser built from Firefox source tree

nixos-unstable 152.0
- nixpkgs-unstable 152.0.4
- nixos-unstable-small 153.0
nixos-26.05 152.0.4
- nixos-26.05-small 152.0.6
- nixpkgs-26.05-darwin 152.0.4

pkgs.pkgsRocm.firefox-devedition

Web browser built from Firefox Developer Edition source tree

nixos-unstable 152.0b8
- nixpkgs-unstable 152.0b8
- nixos-unstable-small 153.0b13
nixos-26.05 152.0b1
- nixos-26.05-small 153.0b13
- nixpkgs-26.05-darwin 152.0b1

pkgs.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable 152.0b8
- nixpkgs-unstable 152.0b8
- nixos-unstable-small 153.0b13
nixos-26.05 152.0b1
- nixos-26.05-small 153.0b13
- nixpkgs-26.05-darwin 152.0b1

pkgs.pkgsRocm.firefox-beta-unwrapped

Web browser built from Firefox Beta Release source tree

nixos-unstable 151.0b9
- nixpkgs-unstable 152.0b10
- nixos-unstable-small 153.0b13
nixos-26.05 152.0b10
- nixos-26.05-small 153.0b13
- nixpkgs-26.05-darwin 152.0b10

pkgs.gnomeExtensions.firefox-profiles

Easily launch Firefox with your favorite profile right from the indicator menu!

nixos-unstable 7
- nixpkgs-unstable 7
- nixos-unstable-small 7
nixos-26.05 7
- nixos-26.05-small 7
- nixpkgs-26.05-darwin 7

pkgs.pkgsRocm.firefox-devedition-unwrapped

Web browser built from Firefox Developer Edition source tree

nixos-unstable 152.0b8
- nixpkgs-unstable 152.0b8
- nixos-unstable-small 153.0b13
nixos-26.05 152.0b1
- nixos-26.05-small 153.0b13
- nixpkgs-26.05-darwin 152.0b1

pkgs.gnomeExtensions.firefox-pip-always-on-top

Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces

nixos-unstable 4
- nixpkgs-unstable 4
- nixos-unstable-small 4
nixos-26.05 4
- nixos-26.05-small 4
- nixpkgs-26.05-darwin 4

pkgs.gnomeExtensions.pip-alwaysontop-for-firefox

Enable Picture-in-Picture(PIP) mode to always be on for Firefox in Gnome.

nixos-unstable 1
- nixpkgs-unstable 1
- nixos-unstable-small 1
nixos-26.05 1
- nixos-26.05-small 1
- nixpkgs-26.05-darwin 1

pkgs.vscode-extensions.firefox-devtools.vscode-firefox-debug

Visual Studio Code extension for debugging web applications and browser extensions in Firefox

nixos-unstable 2.15.0
- nixpkgs-unstable 2.15.0
- nixos-unstable-small 2.15.0
nixos-26.05 2.15.0
- nixos-26.05-small 2.15.0
- nixpkgs-26.05-darwin 2.15.0

Package maintainers

@pmahoney Patrick Mahoney <pat@polycrystal.org>
@magnetophon Bart Brouns <bart@magnetophon.nl>
@jopejoe1 jopejoe1 <nixpkgs@missing.ninja>
@rhendric Ryan Hendrickson
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
@nekowinston winston <hey@winston.sh>
@ambroisie Bruno BELANYI <bruno.nixpkgs@belanyi.fr>
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
@schnusch schnusch
@unode Renato Alves <alves.rjc@gmail.com>
@pasqui23 pasqui23 <p3dimaria@hotmail.it>
@camillemndn Camille M. <camillemondon@free.fr>
@honnip Jung seungwoo <me@honnip.page>
@felschr Felix Schröter <dev@felschr.com>
@philiptaron Philip Taron <philip.taron@gmail.com>

Permalink CVE-2026-56582

3.1 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 month, 1 week ago Activity log

Created suggestion 1 month, 1 week ago

HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability.

HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL padding oracle attack.