NixOS nixpkgs

• CVE-2026-61828 High 8.5 nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server` 0.2%
• CVE-2026-25740 Medium 5.8 Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module 0.2%
• CVE-2026-25137 Critical 9.1 NixOs Odoo database and filestore publicly accessible with default odoo configuration 10.3%
• CVE-2026-23838 High 8.7 Tandoor Recipes module allows SQLite database to be externally accessible with the default settings 0.5%
• CVE-2025-64766 Medium 5.3 NixOS has hardcoded credentials in Onlyoffice module 0.3%
• CVE-2025-32438 High 8.8 Local privilege escalation in make-initrd-ng 0.2%