Issues

• Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

  1.severity: security
  NixOS/nixpkgs#581718 · Filter by author nixpkgs-security-tracker opened on Nov 1, 2026

• epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install

  1.severity: security
  NixOS/nixpkgs#581717 · Filter by author nixpkgs-security-tracker opened on Nov 1, 2026

• epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access

  1.severity: security
  NixOS/nixpkgs#581716 · Filter by author nixpkgs-security-tracker opened on Nov 1, 2026

• libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window

  1.severity: security
  NixOS/nixpkgs#581372 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset

  1.severity: security
  NixOS/nixpkgs#581371 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read

  1.severity: security
  NixOS/nixpkgs#581370 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• moodle: security issues < 5.1.8

  1.severity: security
  NixOS/nixpkgs#581368 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026
  1

• python3Packages.fickling: security issues < 0.1.12

  1.severity: security
  NixOS/nixpkgs#581367 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

  1.severity: security
  NixOS/nixpkgs#581366 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• tcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload Length

  1.severity: security
  NixOS/nixpkgs#581365 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler

  1.severity: security
  NixOS/nixpkgs#581364 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

  1.severity: security
  NixOS/nixpkgs#581363 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026
  1

• Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service

  1.severity: security
  NixOS/nixpkgs#581362 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching

  1.severity: security
  NixOS/nixpkgs#581361 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• n8n: security issues < 2.46.3

  1.severity: security
  NixOS/nixpkgs#581360 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

  1.severity: security
  NixOS/nixpkgs#581359 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• uhttpd: HTTP request smuggling via ubus POST body parse-error desync

  1.severity: security
  NixOS/nixpkgs#581358 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page

  1.severity: security
  NixOS/nixpkgs#581356 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal

  1.severity: security
  NixOS/nixpkgs#581355 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive

  1.severity: security
  NixOS/nixpkgs#581354 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026
  3

  

• Unauthenticated RCE vulnerability against ClickHouse Server

  1.severity: security
  NixOS/nixpkgs#581353 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026
  

• collabora-online: security issues < 25.04.11

  1.severity: security
  NixOS/nixpkgs#581352 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• immich: security issues < 3.3.0

  1.severity: security
  NixOS/nixpkgs#581351 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026
  2

• jellyfin: security issues < 12.0

  1.severity: security
  NixOS/nixpkgs#581350 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026

• tesseract: security issues < 5.5.4

  1.severity: security
  NixOS/nixpkgs#581348 · Filter by author nixpkgs-security-tracker opened on Oct 31, 2026