Skip to content
OpenAdvisories

Product · NixOS

nixpkgs

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.5
    CVE-2026-61828

    nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`

    Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unp…

    NixOS nixpkgs
  • High 8.7
    CVE-2026-23838

    Tandoor Recipes module allows SQLite database to be externally accessible with the default settings

    Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration of Tandoor Recipes, specifically using SQLite and default `MEDIA_ROOT`, the full…

    NixOS nixpkgs
  • High 8.8
    CVE-2025-32438

    Local privilege escalation in make-initrd-ng

    make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during s…

    NixOS nixpkgs