597 matches found
NGINX_2026_CVE_Bundle_CTI_Report
🛡️ NGINX 2026 Multi-CVE CTI Investigation CVE-2026-28755 • CVE-2026-42926 • CVE-2026-9256 • CVE-2026-42055 • CVE-2026-42533 Created by Pratik Chhetri Report Date: 2026-07-28 📌 Executive Snapshot CVE| Component| Primary Issue| Fixed Open Source Versions| Priority ---|---|---|---|--- CVE-2026-28755|...
CVE-2026-97629
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
CVE-2026-101936
A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an adjacent network attacker to cause a denial of service of the data plane via malformed firewall-authentication synchronization traffic on chassis-cluster fabric interfaces...
CVE-2026-101937
A Signed to Unsigned Conversion Error vulnerability exists in the srxpfe component of Juniper Networks Junos OS on the SRX Series . This flaw allows an adjacent attacker to trigger a denial of service (DoS) of the data plane by targeting chassis-cluster fabric traffic when chassis-cluster high av...
DEBIAN-CVE-2026-97629
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
CVE-2026-97629
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
DEBIAN-CVE-2026-93479
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...
CVE-2026-15176
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable...
CVE-2026-104939
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external...
DEBIAN-CVE-2026-101019
Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...
CVE-2026-104939
The NGINX Ingress Controller is affected by a vulnerability (CWE-303) involving the incorrect implementation of an authentication algorithm . Specifically, the controller may mishandle HTTP responses from an OAuth Identity Provider (IdP) when implementing an externalAuth policy for ingress. This ...
CVE-2026-104939 NGINX Ingress Controller vulnerability
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external...
EUVD-2026-101122
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external...
EUVD-2026-101120
Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with...
CVE-2026-101019 NGINX ngx_http_js_module vulnerability
Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...
CVE-2026-101019
The NGINX JavaScript (njs) module contains a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends, the $attr$Name getter may return undefined for attributes containing internal entit...
CVE-2026-94197 NGINX Ingress Controller vulnerability
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller NIC when configured with the ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and...
EUVD-2026-101116
Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as authbasic "";. A namespaced authenticated attacker that configures...
EUVD-2026-101114
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...
CVE-2026-97629
The ngx_http_ssl_module in NGINX Plus , NGINX Open Source , and related F5 products (such as NGINX Instance Manager , F5 WAF for NGINX , and NGINX Gateway Fabric ) is vulnerable to a session forgery flaw. When configured with ssl_session_cache shared:name:size without an explicit ssl_session_tick...