NI
Vendor
NixOS
37
CVEs
1
On KEV
5
New 30D
Products
NI8.8
nix
NixOS
18 CVEs0 on KEV5 new
NI9.8
Nixos
Nixos
7 CVEs1 on KEV0 new
NI9.1
nixpkgs
NixOS
6 CVEs0 on KEV0 new
HY7.5
hydra
NixOS
5 CVEs0 on KEV0 new
CA5.5
Calamares-nixos-extensions
Nixos
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110453 | NI Nix NixOS | 4.3 | Oct 14 | Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients |
| CVE-2026-110452 | NI Nix NixOS | 4.0 | Oct 14 | The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership |
| CVE-2026-110451 | NI Nix NixOS | 4.3 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled |
| CVE-2026-110450 | NI Nix NixOS | 8.0 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification |
| CVE-2026-110449 | NI Nix NixOS | 7.5 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled |
| CVE-2026-64846 | NI nix NixOS | 2.8 | Aug 20 | Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature |
| CVE-2026-61828 | NI nixpkgs NixOS | 8.5 | Jul 15 | nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server` |
| CVE-2026-44029 | NI Nix NixOS | 5.3 | May 5 | An issue was discovered in Nix before 2.34.7 |
| CVE-2026-44028 | NI Nix NixOS | 7.5 | May 5 | An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2 |
| CVE-2026-31431 In wildKEV | NI Nixos Nixos | 7.8 | Apr 22 | crypto: algif_aead - Revert to operating out-of-place |
| CVE-2026-39860 | NI nix NixOS | 8.4 | Apr 8 | Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination |
| CVE-2026-25740 | NI nixpkgs NixOS | 5.8 | Feb 9 | Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module |
| CVE-2026-25137 | NI nixpkgs NixOS | 9.1 | Feb 2 | NixOs Odoo database and filestore publicly accessible with default odoo configuration |
| CVE-2026-23838 | NI nixpkgs NixOS | 8.7 | Jan 19 | Tandoor Recipes module allows SQLite database to be externally accessible with the default settings |
| CVE-2025-64766 | NI nixpkgs NixOS | 5.3 | Nov 17 | NixOS has hardcoded credentials in Onlyoffice module |
| CVE-2025-54864 | HY hydra NixOS | 7.5 | Aug 12 | Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins |
| CVE-2025-54800 | HY hydra NixOS | 6.1 | Aug 12 | Hydra persistent XSS in build metrics |
| CVE-2025-53819 | NI nix NixOS | 7.9 | Jul 14 | Nix's privilege dropping to build user broke for macOS |
| CVE-2025-52992 | NI Nix NixOS | 3.2 | Jun 27 | The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails |
| CVE-2025-46416 | NI Nix NixOS | 2.9 | Jun 27 | The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild) |
| CVE-2025-46415 | NI Nix NixOS | 3.2 | Jun 27 | A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders |
| CVE-2025-52993 | NI Nix NixOS | 5.6 | Jun 27 | A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*) |
| CVE-2025-52991 | NI Nix NixOS | 3.2 | Jun 27 | The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location |
| CVE-2025-32435 | HY hydra NixOS | 2.6 | Apr 15 | Hydra no restricted eval after nix-eval-jobs migration |
| CVE-2025-32438 | NI nixpkgs NixOS | 8.8 | Apr 15 | Local privilege escalation in make-initrd-ng |
| CVE-2024-12084 | NI Nixos Nixos | 9.8 | Jan 15 | Rsync: heap buffer overflow in rsync due to improper checksum length handling |
| CVE-2024-12086 | NI Nixos Nixos | 6.8 | Jan 14 | A flaw was found in rsync |
| CVE-2024-12087 | NI Nixos Nixos | 7.5 | Jan 14 | Rsync: path traversal vulnerability in rsync |
| CVE-2024-12088 | NI Nixos Nixos | 7.5 | Jan 14 | Rsync: --safe-links option bypass leads to path traversal |
| CVE-2024-12085 | NI Nixos Nixos | 7.5 | Jan 14 | Rsync: info leak via uninitialized stack contents |
| CVE-2024-45593 | NI nix NixOS | 8.8 | Sep 10 | Nix affected by unsafe NAR unpacking |
| CVE-2024-45049 | HY Hydra Nixos | 7.5 | Aug 27 | Hydra is a Continuous Integration service for Nix based projects |
| CVE-2024-32657 | HY Hydra Nixos | 5.4 | Apr 22 | Hydra is a Continuous Integration service for Nix based projects |
| CVE-2024-27297 | NI Nix Nixos | 5.9 | Mar 11 | Nix is a package manager for Linux and other Unix systems |
| CVE-2023-36476 | CA Calamares-nixos-extensions Nixos | 5.5 | Jun 29 | calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux |
| CVE-2019-17365 | NI Nix Nixos | 7.8 | Oct 9 | Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable |
| CVE-2017-7412 | NI Nixos Nixos | 7.8 | Apr 4 | NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands |