What’s Vulnerable › Products

NixOS nixpkgs vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your NixOS nixpkgs version is affected

Latest NixOS nixpkgs vulnerabilities

• CVE-2026-61828 — nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server` (CVSS 8.5)
• CVE-2026-25740 — Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module (CVSS 5.8)
• CVE-2026-25137 — NixOs Odoo database and filestore publicly accessible with default odoo configuration (CVSS 9.1)
• CVE-2026-23838 — Tandoor Recipes module allows SQLite database to be externally accessible with the default settings (CVSS 8.7)
• CVE-2025-64766 — NixOS has hardcoded credentials in Onlyoffice module (CVSS 5.3)
• CVE-2025-32438 — Local privilege escalation in make-initrd-ng (CVSS 8.8)