CentOS Linux 8 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1778142227)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1778142227 advisory. - A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS...

CentOS Linux 8.4 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.4:CLSA-2026:1788337370)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1788337370 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side...

ROOT-OS-ALPINE-320-CVE-2026-27651 CVE-2026-27651 in nginx - Patched by Root

Root has patched CVE-2026-27651 in the nginx package for Root:Alpine:3.20. Multiple fixed versions available...

ROOT-OS-ALPINE-320-CVE-2026-1642 CVE-2026-1642 in nginx - Patched by Root

Root has patched CVE-2026-1642 in the nginx package for Root:Alpine:3.20. Multiple fixed versions available...

ROOT-OS-ALPINE-320-CVE-2026-42946 CVE-2026-42946 in nginx - Patched by Root

Root has patched CVE-2026-42946 in the nginx package for Root:Alpine:3.20. Multiple fixed versions available...

ROOT-OS-ALPINE-320-CVE-2026-42533 CVE-2026-42533 in nginx - Patched by Root

Root has patched CVE-2026-42533 in the nginx package for Root:Alpine:3.20. Multiple fixed versions available...

ROOT-OS-ALPINE-320-CVE-2026-32647 CVE-2026-32647 in nginx - Patched by Root

Root has patched CVE-2026-32647 in the nginx package for Root:Alpine:3.20. Multiple fixed versions available...

ROOT-OS-ALPINE-320-CVE-2026-42945 CVE-2026-42945 in nginx - Patched by Root

Root has patched CVE-2026-42945 in the nginx package for Root:Alpine:3.20. Multiple fixed versions available...

ROOT-OS-ALPINE-320-CVE-2026-27654 CVE-2026-27654 in nginx - Patched by Root

Root has patched CVE-2026-27654 in the nginx package for Root:Alpine:3.20. Multiple fixed versions available...

ROOT-OS-ALPINE-320-CVE-2026-56434 CVE-2026-56434 in nginx - Patched by Root

Root has patched CVE-2026-56434 in the nginx package for Root:Alpine:3.20. Multiple fixed versions available...

ROOT-OS-ALPINE-320-CVE-2026-60005 CVE-2026-60005 in nginx - Patched by Root

Root has patched CVE-2026-60005 in the nginx package for Root:Alpine:3.20. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-32647 CVE-2026-32647 in nginx - Patched by Root

Root has patched CVE-2026-32647 in the nginx package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-1642 CVE-2026-1642 in nginx - Patched by Root

Root has patched CVE-2026-1642 in the nginx package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-27651 CVE-2026-27651 in nginx - Patched by Root

Root has patched CVE-2026-27651 in the nginx package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-27654 CVE-2026-27654 in nginx - Patched by Root

Root has patched CVE-2026-27654 in the nginx package for Root:Alpine:3.21. Multiple fixed versions available...

EUVD-2026-88568

Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...

EUVD-2026-88567

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

Important: nginx-mod-njs

Issue Overview: Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An...

Amazon Linux 2 : nginx (ALASNGINX1-2026-016)

The version of nginx installed on the remote host is prior to 1.30.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2026-016 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions =...

CVE-2026-102335

Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...