NixOS records
18 published records for vendor nixos.
Researcher profile
- Entered KEV
- 1 · 5.6%
- Weaponized
- 1 · 5.6%
- Pre-auth RCE
- 0
- With a fix record
- 44.4%
- Median publish → KEV
- 9 days
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2
- CWE-306 Missing Authentication for Critical Function2
- CWE-276 Incorrect Default Permissions1
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition1
- CWE-390 Detection of Error Condition Without Action1
The weakness classes this vendor ships most often: where to look.
CWEAll records
18 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
90Now | CVE-2026-31431Weaponized | crypto: algif_aead - Revert to operating out-of-placelinux · linux kernel · CWE-669 | High7.8 | KEV | 98.1% | Apr 22, 2026 |
61This week | CVE-2024-12084Proof of concept | Rsync: heap buffer overflow in rsync due to improper checksum length handlingsamba · rsync · CWE-122 | Critical9.8 | — | 72.5% | Jan 15, 2025 |
35Monitor | CVE-2024-45593No exploit | Nix affected by unsafe NAR unpackingnixos · nix · CWE-22 | High8.8 | — | 0.6% | Sep 10, 2024 |
33Monitor | CVE-2024-12085Proof of concept | Rsync: info leak via uninitialized stack contentssamba · rsync · CWE-908 | High7.5 | — | 8.6% | Jan 14, 2025 |
33Monitor | CVE-2026-39860No exploit | Nix sandbox escape: file write via symlink at FOD `.tmp` copy destinationlinux · linux kernel · CWE-61 | High8.4 | — | 0.1% | Apr 8, 2026 |
31Monitor | CVE-2024-12088No exploit | Rsync: --safe-links option bypass leads to path traversalsamba · rsync · CWE-22 | High7.5 | — | 4.6% | Jan 14, 2025 |
31Monitor | CVE-2024-12087No exploit | Rsync: path traversal vulnerability in rsyncsamba · rsync · CWE-22 | High7.5 | — | 2.2% | Jan 14, 2025 |
31Monitor | CVE-2019-17365No exploit | Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directorienixos · nix · CWE-276 | High7.8 | — | 0.4% | Oct 9, 2019 |
31Monitor | CVE-2017-7412No exploit | NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands.nixos · nixos | High7.8 | — | 0.3% | Apr 3, 2017 |
31Monitor | CVE-2024-43378No exploit | calamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systemsnixos · calamares-nixos-extensions · CWE-256 | High7.8 | — | 0.1% | Aug 15, 2024 |
30Monitor | CVE-2024-45049No exploit | Nix Hydra Missing authentication when triggering evaluationsnixos · hydra · CWE-306 | High7.5 | — | 0.6% | Aug 27, 2024 |
28Monitor | CVE-2024-12086No exploit | Rsync: rsync server leaks arbitrary client filessamba · rsync · CWE-390 | Medium6.8 | — | 1.7% | Jan 14, 2025 |
28Monitor | CVE-2025-54800No exploit | Hydra persistent XSS in build metricsnixos · hydra · CWE-79 | High7.1 | — | 0.2% | Aug 12, 2025 |
27Monitor | CVE-2025-54864No exploit | Hydra missing authentication when triggering evaluations through GitHub and Gitea pluginsnixos · hydra · CWE-306 | Medium6.9 | — | 0.4% | Aug 12, 2025 |
23Monitor | CVE-2024-27297No exploit | Nix Corruption of fixed-output derivationsnixos · nix · CWE-367 | Medium5.9 | — | 0.5% | Mar 11, 2024 |
22Monitor | CVE-2023-36476No exploit | `calamares-nixos-extensions` LUKS keyfile exposurenixos · calamares-nixos-extensions · CWE-200 | Medium5.5 | — | 0.2% | Jun 28, 2023 |
21Monitor | CVE-2024-32657No exploit | Hydra has persistent XSS vulnerability serving HTML build outputsnixos · hydra · CWE-79 | Medium5.4 | — | 0.4% | Apr 22, 2024 |
10Monitor | CVE-2025-32435No exploit | Hydra no restricted eval after nix-eval-jobs migrationnixos · hydra · CWE-95 | Low2.6 | — | 0.3% | Apr 15, 2025 |
- CVE-2026-3143190Now
crypto: algif_aead - Revert to operating out-of-place
HighCVSS 7.8KEVWeaponizedEPSS 98%linux · linux kernelApr 22, 2026
- CVE-2024-1208461This week
Rsync: heap buffer overflow in rsync due to improper checksum length handling
CriticalCVSS 9.8Proof of conceptEPSS 72%samba · rsyncJan 15, 2025
- CVE-2024-4559335Monitor
Nix affected by unsafe NAR unpacking
HighCVSS 8.8No exploitEPSS 0%nixos · nixSep 10, 2024
- CVE-2024-1208533Monitor
Rsync: info leak via uninitialized stack contents
HighCVSS 7.5Proof of conceptEPSS 8%samba · rsyncJan 14, 2025
- CVE-2026-3986033Monitor
Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination
HighCVSS 8.4No exploitEPSS 0%linux · linux kernelApr 8, 2026
- CVE-2024-1208831Monitor
Rsync: --safe-links option bypass leads to path traversal
HighCVSS 7.5No exploitEPSS 4%samba · rsyncJan 14, 2025
- CVE-2024-1208731Monitor
Rsync: path traversal vulnerability in rsync
HighCVSS 7.5No exploitEPSS 2%samba · rsyncJan 14, 2025
- CVE-2019-1736531Monitor
Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directorie
HighCVSS 7.8No exploitEPSS 0%nixos · nixOct 9, 2019
- CVE-2017-741231Monitor
NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands.
HighCVSS 7.8No exploitEPSS 0%nixos · nixosApr 3, 2017
- CVE-2024-4337831Monitor
calamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systems
HighCVSS 7.8No exploitEPSS 0%nixos · calamares-nixos-extensionsAug 15, 2024
- CVE-2024-4504930Monitor
Nix Hydra Missing authentication when triggering evaluations
HighCVSS 7.5No exploitEPSS 0%nixos · hydraAug 27, 2024
- CVE-2024-1208628Monitor
Rsync: rsync server leaks arbitrary client files
MediumCVSS 6.8No exploitEPSS 1%samba · rsyncJan 14, 2025
- CVE-2025-5480028Monitor
Hydra persistent XSS in build metrics
HighCVSS 7.1No exploitEPSS 0%nixos · hydraAug 12, 2025
- CVE-2025-5486427Monitor
Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins
MediumCVSS 6.9No exploitEPSS 0%nixos · hydraAug 12, 2025
- CVE-2024-2729723Monitor
Nix Corruption of fixed-output derivations
MediumCVSS 5.9No exploitEPSS 0%nixos · nixMar 11, 2024
- CVE-2023-3647622Monitor
`calamares-nixos-extensions` LUKS keyfile exposure
MediumCVSS 5.5No exploitEPSS 0%nixos · calamares-nixos-extensionsJun 28, 2023
- CVE-2024-3265721Monitor
Hydra has persistent XSS vulnerability serving HTML build outputs
MediumCVSS 5.4No exploitEPSS 0%nixos · hydraApr 22, 2024
- CVE-2025-3243510Monitor
Hydra no restricted eval after nix-eval-jobs migration
LowCVSS 2.6No exploitEPSS 0%nixos · hydraApr 15, 2025