Advisories · Technology
NixOS nixpkgs.
Every CVE that names NixOS nixpkgs among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.5 High
nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`
- NixOS nixpkgs
- Broken access control
- CVSS 5.8 Medium
Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module
- NixOS nixpkgs
- Privilege escalation
- CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
NixOs Odoo database and filestore publicly accessible with default odoo configuration
- NixOS nixpkgs
- Authentication bypass
- Information disclosure
- CVSS 8.7 High
Tandoor Recipes module allows SQLite database to be externally accessible with the default settings
- NixOS nixpkgs
- Information disclosure
- CVSS 5.3 Medium
NixOS has hardcoded credentials in Onlyoffice module
- NixOS nixpkgs
- Hard-coded credentials
- CVSS 8.8 High
Local privilege escalation in make-initrd-ng
- NixOS nixpkgs
- CWE-378
- CWE-379