Browse CVEs

HIGH 8.4 CVE-2026-39860 Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by … Nix 2.28.6 / 2.29.3+ Fix from $1,9502026-04-08 HIGH 7.5 CVE-2025-54864 Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the cor… Hydra 2025-08-12+ Fix from $1,9502025-08-12 MEDIUM 6.1 CVE-2025-54800 Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript cod… Hydra 2025-08-12+ Fix from $1,6002025-08-12 HIGH 8.8 CVE-2024-45593 Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR th… Nix 2.24.6+ Fix from $1,9502024-09-10 HIGH 7.5 CVE-2024-45049 Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Dependin… Hydra 2024-08-27+ Fix from $1,9502024-08-27 MEDIUM 5.4 CVE-2024-32657 Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute au… Hydra 23.11+ Fix from $1,6002024-04-22 MEDIUM 5.9 CVE-2024-27297 Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to… Nix 2.3.18 / 2.18.2+ Fix from $1,6002024-03-11 MEDIUM 5.5 CVE-2023-36476 calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions versio… Calamares Nixos Extensions 0.3.13+ Fix from $1,6002023-06-29 HIGH 7.8 CVE-2019-17365 Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is worl… Nix after 2.3 Fix from $1,9502019-10-09 HIGH 7.8 CVE-2017-7412 NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands. Nixos Patch available Fix from $1,9502017-04-04