← All distributions
Updated 09:00
Determinate Secure Packages distribution
secure-packages-rollingSupportedFIPS supported
Built on Nixpkgs master. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
234
Fixed in the last 7 days
119
In progress
370
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-rolling-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
604 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| Fixed | Medium | Out-of-bounds read vulnerability in Apache Thrift before 0.23.0 | Oct 12, 2026 | |
| Fixed | Medium | Uncontrolled recursion vulnerability in Apache Thrift versions prior to 0.23.0 | Oct 12, 2026 | |
| Fixed | High | Integer overflow/wraparound vulnerability in Apache Thrift versions prior to 0.23.0 | Oct 12, 2026 | |
| Fixed | High | Out-of-bounds read vulnerability in Apache Thrift versions before 0.23.0 | Oct 12, 2026 | |
| Fixed | High | Integer overflow/wraparound in Apache Thrift Go TFramedTransport before 0.23.0 | Oct 12, 2026 | |
| Fixed | Critical | SimpleEval <1.0.5 sandbox escape via object attribute leakage and unsafe callback access | Oct 12, 2026 | |
| Fixed | High | Mismatched memory management in Thrift c_glib pre-0.23.0 crashes servers on crafted requests | Oct 12, 2026 | |
| Fixed | Low | Zulip 6.1 and below invite UI bypasses stream-adding permissions for invited users | Oct 12, 2026 | |
| Fixed | Low | Zulip auth bypass: LDAP+external backends allow non-LDAP account creation when invites disabled | Oct 12, 2026 | |
| Fixed | Medium | Zulip remote image proxy bypass leaks viewer IP/fingerprint via crafted message URLs | Oct 12, 2026 | |
| Fixed | Medium | Zulip Mobile <=27.189: Crafted message links can disclose user credentials | Oct 12, 2026 | |
| Fixed | High | Incorrect authorization in Zulip <=5.4 lets members make their bots organization administrators | Oct 12, 2026 | |
| Fixed | Critical | Zulip Server <4.9 leaves RabbitMQ 25672 open; weak cookie allows RCE and message snooping | Oct 12, 2026 | |
| Fixed | Medium | Zulip: Registration accepts expired invitation keys due to missing /accounts/register validation | Oct 12, 2026 | |
| Fixed | Medium | Zulip linkifier regex allows admin-triggered ReDoS; validation regex also vulnerable to ReDoS. | Oct 12, 2026 | |
| Fixed | High | Improper access control in GitHub repository zulip/zulip prior to 4.10 | Oct 12, 2026 | |
| Fixed | Medium | Stored cross-site scripting vulnerability in zulip/zulip from 44f935695d452cc3fb16845a0c6af710438b153d to before 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6 | Oct 12, 2026 | |
| Fixed | High | Zulip <1.3.12 allows deactivated users to access messages with SSO enabled | Oct 12, 2026 | |
| Fixed | Medium | Zulip pre-1.3.12 exposed bot API keys to other users in the same realm | Oct 12, 2026 | |
| Fixed | High | cgroup css_task_iter may resurrect zero-refcount dying tasks, causing use-after-free race | Oct 9, 2026 | |
| Fixed | Medium | pmem_submit_bio records PREFLUSH error but overwritten by FUA, allowing writes post-failure | Oct 9, 2026 | |
| Fixed | Medium | staging: rtl8723bs: kfree used on vzalloc-backed HalData in rtw_sdio_if1_init error path | Oct 9, 2026 | |
| Fixed | Medium | nvmet-rdma leaks queues and IB resources when connect backlog exceeded by pending disconnects | Oct 9, 2026 | |
| Fixed | Medium | Bluetooth hci_core race: power_on before msft_register causes uninitialized MSFT filter_lock mutex use | Oct 9, 2026 | |
| Fixed | High | Btrfs use-after-free via double transaction end after RAID stripe extent allocation failure | Oct 9, 2026 | |
| Fixed | Medium | btrfs bioc_list memory leak on btrfs_ordered_extent errors and skipped RAID insertion | Oct 9, 2026 | |
| Fixed | Medium | Btrfs qgroup snapshot accounting triggers reloc root, corrupts backrefs, flips filesystem read-only | Oct 9, 2026 | |
| Fixed | Medium | BPF tp_btf dereferences signal_generate/signal_deliver siginfo 0/1 sentinels, panicking kernel | Oct 9, 2026 | |
| Fixed | Medium | ASoC Intel avs: strace_open leaks module ref on subsequent failure after try_module_get | Oct 9, 2026 | |
| Fixed | Medium | Out-of-bounds init_configs access in ASoC Intel avs due to invalid ID indexing | Oct 9, 2026 | |
| Fixed | High | bcmasp: stale txcb->last on descriptor reuse frees SKB mid-transmit | Oct 9, 2026 | |
| Fixed | Medium | bcmasp tx_spb_ring_full() checks same descriptor slot repeatedly due to next_index reset | Oct 9, 2026 | |
| Fixed | High | mlxsw spectrum_ptp: napi_gro_receive() called from GC workqueue causes concurrent GRO list corruption, panic | Oct 9, 2026 | |
| Fixed | High | OpenSSL 4.0 X.509 extension cache race causes use-after-free, DoS in multithreaded TLS | Oct 9, 2026 | |
| Fixed | Medium | GStreamer gst-plugins-good avidemux FUJIFILM strd underflow causes heap OOB read/write, info leak, crash | Oct 9, 2026 | |
| Fixed | High | Chrome: WebRTC buffer overflow enables remote sandboxed code execution via crafted HTML (pre-154.0.8037.97) | Oct 9, 2026 | |
| Fixed | Critical | Chrome FedCM use-after-free before 154.0.8037.97 enables remote code execution outside sandbox via HTML | Oct 9, 2026 | |
| Fixed | Medium | Skia integer overflow in Chrome before 154.0.8037.97 enables cross-origin data exfiltration via crafted HTML | Oct 9, 2026 | |
| Fixed | Critical | Critical WebGL out-of-bounds write in Chrome <154.0.8037.97 enables remote sandbox-escape RCE | Oct 9, 2026 | |
| Fixed | Medium | Remote info disclosure via SVG in Chrome <154.0.8037.97 through crafted HTML | Oct 9, 2026 | |
| Fixed | Critical | Chrome Windows FileSystem auth bug enables sandbox escape and RCE via crafted HTML page | Oct 9, 2026 | |
| Fixed | High | V8 type confusion in Chrome <154.0.8037.97 enables remote sandboxed RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | High | Chrome Windows pre-154.0.8037.97: UAF in Contextual Tasks enables sandbox escape RCE | Oct 9, 2026 | |
| Fixed | High | Chrome MediaStream use-after-free enables remote code execution in sandbox (pre-154.0.8037.97) | Oct 9, 2026 | |
| Fixed | High | Use-after-free in Chrome SVG <154.0.8037.97 enables sandboxed RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome pre-154.0.8037.97 Compositing integer overflow enables remote cross-origin data leak via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | High-severity Chrome WebGPU uninitialized resource allowed cross-origin data exfiltration (pre-154.0.8037.92) | Oct 9, 2026 | |
| Fixed | High | PyJWT PyJWKSet fails on malformed RSA JWK, causing authentication failures/DoS before 2.14.0 | Oct 9, 2026 | |
| Fixed | High | PyJWT 2.13.x HMAC key guard flaw accepts public JWK, allowing token forgery | Oct 9, 2026 | |
| Fixed | High | PyJWT 2.13.0-2.14.0 BOM JWK parsing flaw enables HMAC misuse, token forgery | Oct 9, 2026 |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.