NixOS nixpkgs vulnerabilities

CVEs per yearBy the year they were published

1. 20252
2. 20264

Newest CVEs

• CVE-2026-61828

  nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`

  NixOS · nixpkgs

  High8.5
• CVE-2026-25740

  Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module

  NixOS · nixpkgs

  Medium5.8
• CVE-2026-25137

  NixOs Odoo database and filestore publicly accessible with default odoo configuration

  NixOS · nixpkgs

  Critical9.1
• CVE-2026-23838

  Tandoor Recipes module allows SQLite database to be externally accessible with the default settings

  NixOS · nixpkgs

  High8.7
• CVE-2025-64766

  NixOS has hardcoded credentials in Onlyoffice module

  NixOS · nixpkgs

  Medium5.3
• CVE-2025-32438

  Local privilege escalation in make-initrd-ng

  NixOS · nixpkgs

  High8.8