Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
343 results · page 3 of 7
May 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-44015 · Other software · 0xJacky · reported by GitHubHigh 8.5
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2026-42268 · Other software · owasp-modsecurity · reported by GitHubHigh 8.2
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception (std::out_of_range) caused by unsigned integer underflow in libmodsecurity3 if the user (administrator) uses a rule any of @verifySSN, @verifyCPF, or @verifySVNR. This vulnerability is fixed in 3.0.15.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackCVE-2026-8430 · Other software · SPIP · reported by VulnCheckCritical 9.2
SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability through specific nginx configuration scenarios to achieve code execution, and this issue is not mitigated by the SPIP security screen.
- Product
- SPIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.spip.netvulncheck.com
May 5, 2026ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.CVE-2026-30923 · Other software · owasp-modsecurity · reported by GitHubHigh 8.2
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a single character. An attacker can exploit this to crash worker processes, causing a denial of service. Service resumes once the attack stops as worker processes recover from the segfault. All versions before 3.0.15 of libModSecurity3 are affected. This has been patched in version 3.0.15.
- Product
- ModSecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42238 · Other software · 0xJacky · reported by GitHubCritical 9
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites the application's configuration file (app.ini) and SQLite database. Because the attacker controls the restored app.ini, they can inject an arbitrary OS command into the TestConfigCmd setting. After the application automatically restarts to apply the restored config, a single follow-up request triggers that command as the user running nginx-ui — typically root in Docker deployments. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42223 · Other software · 0xJacky · reported by GitHubMedium 6.5
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with protected:"true" - however, this tag is only enforced during writes (via ProtectedFill in SaveSettings) and is completely ignored during reads. This exposes 40+ protected fields including JwtSecret (enabling auth token forgery), NodeSecret (enabling cluster node impersonation), OIDC ClientSecret (enabling OAuth account takeover), and the IP whitelist configuration. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42222 · Other software · 0xJacky · reported by GitHubHigh 8.1
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42221 · Other software · 0xJacky · reported by GitHubHigh 8.1
Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42220 · Other software · 0xJacky · reported by GitHubMedium 6.5
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.CVE-2026-33208 · Other software · roxy-wi · reported by GitHubHigh 7.4
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /config/ < service > /find-in-config endpoint in Roxy-WI fails to sanitize the user-supplied words parameter before embedding it into a shell command string that is subsequently executed on a remote managed server via SSH. An authenticated attacker can inject arbitrary shell metacharacters to break out of the intended grep command context and execute arbitrary OS commands with sudo privileges on the target server, resulting in full Remote Code Execution (RCE). Version 8.2.6.4 patches the issue.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.CVE-2026-33078 · Other software · roxy-wi · reported by GitHubHigh 8.9
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the URL path, is passed unsanitized through multiple function calls and ultimately interpolated into a SQL query string using Python string formatting, allowing attackers to execute arbitrary SQL commands. Version 8.2.6.4 fixes the issue.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.CVE-2026-33077 · Other software · roxy-wi · reported by GitHubHigh 7.7
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the oldconfig parameter in the haproxy_section_save interface has an arbitrary file read vulnerability. Version 8.2.6.4 fixes the issue.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.CVE-2026-33076 · Other software · roxy-wi · reported by GitHubHigh 8.9
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface presents a vulnerability that could lead to remote code execution due to path traversal and writing into scheduled tasks. Version 8.2.6.4 fixes the issue.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-34403 · Other software · 0xJacky · reported by GitHubMedium 5.5
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that authentication tokens are stored in browser cookies (set via JavaScript without HttpOnly or explicit SameSite attributes), a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance when a logged-in administrator visits the attacker-controlled page. Version 2.3.5 patches the issue.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.CVE-2026-33432 · Other software · roxy-wi · reported by GitHubHigh 7.7
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters. An unauthenticated attacker can inject LDAP filter metacharacters into the username field to manipulate the search query, cause the directory to return an unintended user entry, and bypass authentication entirely — gaining access to the application without knowing any valid password. As of time of publication, no known patches are available.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.CVE-2026-33431 · Other software · roxy-wi · reported by GitHubMedium 5.7
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config/<service>/show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and its contents returned to the caller. The existing path traversal guard only inspects the base directory variable (which is never user-controlled) and entirely ignores the user-supplied configver value. An authenticated attacker can supply a configver value containing `../` sequences to escape the intended directory and read arbitrary files accessible to the web application process. Version 8.2.6.4 contains a patch for the issue.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33031 · Other software · 0xJacky · reported by GitHubHigh 8.6
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an attacker who already stole a JWT can continue reading and modifying protected resources after the account is marked disabled. Since tokens can be used to create new accounts, it is possible the disabled user to maintain the privilege. Version 2.3.4 patches the issue.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33026 · Other software · 0xJacky · reported by GitHubCritical 9.4
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33032 · Other software · 0xJacky · reported by GitHubCritical 9.8
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". This means any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads - achieving complete nginx service takeover. At time of publication, there are no publicly available patches.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33030 · Other software · 0xJacky · reported by GitHubHigh 8.8
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a user_id field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments. At time of publication, there are no publicly available patches.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33029 · Other software · 0xJacky · reported by GitHubMedium 6.9
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33028 · Other software · 0xJacky · reported by GitHubHigh 7.1
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file (app.ini). This vulnerability results in a persistent Denial of Service (DoS) and introduces a non-deterministic path for Remote Code Execution (RCE) through configuration cross-contamination. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33027 · Other software · 0xJacky · reported by GitHubMedium 6.9
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-wriCVE-2026-32647 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.5
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmy.f5.comaccess.redhat.com
Mar 24, 2026NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured wCVE-2026-28755 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.3
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses.CVE-2026-28753 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.3
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NCVE-2026-27784 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.5
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmy.f5.comaccess.redhat.com
Mar 24, 2026NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX wCVE-2026-27654 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.8
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmy.f5.comaccess.redhat.com
Mar 24, 2026When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate.CVE-2026-27651 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmy.f5.comaccess.redhat.com
Mar 19, 2026A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx.CVE-2026-4342 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 8.8
A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
- Product
- ingress-nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Mar 17, 2026Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.CVE-2026-27811 · Other software · roxy-wi · reported by GitHubHigh 8.8
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the `/config/compare/<service>/<server_ip>/show` endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in `app/modules/config/config.py` on line 362, where user input is directly formatted in the template string that is eventually executed. Version 8.2.6.3 fixes the issue.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2026A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration iCVE-2026-3288 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 8.8
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
- Product
- ingress-nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Mar 5, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-27944 · Other software · 0xJacky · reported by GitHubCritical 9.8
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A vulnerability was identified in cym1102 nginxWebUI up to 4.3.7.CVE-2026-2145 · Other software · cym1102 · reported by VulDBLow 2
A vulnerability was identified in cym1102 nginxWebUI up to 4.3.7. The impacted element is an unknown function of the file /adminPage/conf/check of the component Web Management Interface. Such manipulation of the argument nginxDir leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- nginxWebUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject configuCVE-2025-15566 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 8.8
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
- Product
- ingress-nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers.CVE-2026-1642 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.2
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Open Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition.CVE-2026-24514 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 6.5
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx controller pod being killed or the node running out of memory.
- Product
- ingress-nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in the presence of a spCVE-2026-24513 · Other software · Kubernetes · reported by jordan@liggitt.netLow 3.1
A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in the presence of a specific misconfiguration. If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the `auth-url` annotation may be accessed even when authentication fails. Note that the built-in custom-errors backend works correctly. To trigger this issue requires an administrator to specifically configure ingress-nginx with a broken external component.
- Product
- ingress-nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx.CVE-2026-24512 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 8.8
A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
- Product
- ingress-nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration intoCVE-2026-1580 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 8.8
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
- Product
- ingress-nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026The $uri$args concatenation in nginx configuration file present in Open Security Issue Management (OSIM) prior v2025.9.0 allows path traversal attacks via queryCVE-2026-1616 · Other software · Red Hat · reported by 74b3a70d-cca6-4d34-9789-e83b222ae3beHigh 7.5
The $uri$args concatenation in nginx configuration file present in Open Security Issue Management (OSIM) prior v2025.9.0 allows path traversal attacks via query parameters.
- Product
- osim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.CVE-2026-22265 · Other software · roxy-wi · reported by GitHubHigh 7.5
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerability is in app/modules/roxywi/logs.py line 87, where the grep parameter is used twice - once sanitized and once raw. This vulnerability is fixed in 8.2.8.2.
- Product
- roxy-wi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025Varnish/Nginx Proxy Caching: Insertion of Sensitive Information Into Sent DataCVE-2025-62126 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Retrieve Embedded Sensitive Data.This issue affects Varnish/Nginx Proxy Caching: from n/a through <= 1.8.3.
- Product
- Varnish/Nginx Proxy Caching
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update Varnish/Nginx Proxy Caching to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2025A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation.CVE-2025-14727 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Ingress Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2025NGINX Cache Optimizer: Unauthorized modification of dataCVE-2025-12014 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NGINX Cache Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nginxcacheoptimizer-blacklist-update' AJAX action in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add URLs to the Exclude URLs From Dynamic Caching setting.
- Product
- NGINX Cache Optimizer
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update NGINX Cache Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 15, 2025When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App ProCVE-2025-58474 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.9
When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025Varnish/Nginx Proxy Caching: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48360 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Stored XSS.This issue affects Varnish/Nginx Proxy Caching: from n/a through <= 1.8.3.
- Product
- Varnish/Nginx Proxy Caching
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update Varnish/Nginx Proxy Caching to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2025nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure.CVE-2025-55740 · Other software · Anipaleja · reported by GitHubMedium 6.5
nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml contain default credentials (default_password: "change_me_please", GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. The issue is addressed in v1.5.0 and later.
- Product
- nginx-defender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validationCVE-2025-50579 · Other software · Jc21 · reported by MITREMedium 5.3
A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validation of the Origin header. This misconfiguration enables attackers to intercept tokens using a simple browser script and exfiltrate them to a remote attacker-controlled server, potentially leading to unauthorized actions within the application.
- Product
- Nginx Proxy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authenticCVE-2025-53859 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.3
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.