CLSA-2026-1790332938 nginx: Fix of 2 CVEs

CVE-2026-42946: reset the upstream parser state and restore the response buffer position when a status line is not recognised, so proxy, scgi and uwsgi header parsing no longer continues in a stale state or drops already-read data...

CLSA-2026-1790329264 nginx: Fix of 2 CVEs

CVE-2026-42946: reset the upstream parser state and restore the response buffer position when a status line is not recognised, so proxy, scgi and uwsgi header parsing no longer continues in a stale state or drops already-read data...

CLSA-2026-1790328963 nginx: Fix of 2 CVEs

CVE-2026-42946: reset the upstream parser state and restore the response buffer position when a status line is not recognised, so proxy, scgi and uwsgi header parsing no longer continues in a stale state or drops already-read data...

CLSA-2026-1790073266 nginx: Fix of CVE-2026-42946

CVE-2026-42946: reset the status-line parser state on fallback so scgi and uwsgi header parsing can't alias into a leftover FSM state and leak worker memory into response headers...

CLSA-2026-1790072954 nginx: Fix of CVE-2026-42946

CVE-2026-42946: reset the status-line parser state on fallback so scgi and uwsgi header parsing can't alias into a leftover FSM state and leak worker memory into response headers...

CLSA-2026-1790072773 nginx: Fix of CVE-2026-42946

CVE-2026-42946: reset the status-line parser state on fallback so scgi and uwsgi header parsing can't alias into a leftover FSM state and leak worker memory into response headers...

CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-13684

CVE-2026-13684 is an improper encoding or escaping of output vulnerability in the SCGI component of Synology DiskStation Manager (DSM) prior to versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 . The flaw allows remote, unauthenticated attackers to read or write arbitrary files...

EUVD-2026-82772

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

PT-2026-95316

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.2.1-69057-12 Synology DiskStation Manager DSM versions prior to 7.2.2-72806-9 Synology DiskStation Manager DSM versions prior to 7.3.2-86009-4 Synology DiskStation Manager DSM versions prior...

CVE-2026-13684: Improper Encoding or Escaping of Output

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

D-Link DSR - Default Credentials Detection

Tries admin:admin against /scgi-bin/platform.cgi on D-Link DSR devices and looks for authenticated UI markers or already-logged-in session prompts. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSR devices default credentials admin:admin.""" from urllib.parse import quote from kittysploit...

CLSA-2026-1785509707 nginx: Fix of 6 CVEs

CVE-2025-53859: fix buffer over-read in the SMTP authentication path that could disclose worker process memory to the authentication server - CVE-2026-28753: validate host names resolved from the client address to prevent header injection into authhttp and XCLIENT requests - CVE-2026-40701: fix...

Dlink DSR-250 and Netgear Prosafe - Cross-Site Scripting Detection

Dlink DSR-250 and Netgear Prosafe are vulnerable to reflected cross site scripting endpoint scgi-bin/platform.cgi in parameter SSLVPN. !/usr/bin/env python3 -- coding: utf-8 -- """Dlink DSR-250 and Netgear Prosafe are vulnerable to reflected cross site scripting endpoint scgi-bin/platform.""" fro...

ROS-20260626-73-0042

The vulnerability of the ngxhttpscgimodule and ngxhttpuwsgimodule modules in NGINX Plus and NGINX Open Source web servers is related to uncontrolled memory consumption. Exploiting this vulnerability can allow a malicious actor to perform a “man-in-the-middle” attack remotely...

CLSA-2026-1782160000 Fix CVE(s): CVE-2026-42946

SECURITY UPDATE: excessive memory allocation or over-read in scgi and uwsgi status line parsing - debian/patches/CVE-2026-42946.patch: excessive memory allocation or over-read in scgi and uwsgi status line parsing - CVE-2026-42946...

CLSA-2026-1782139370 Fix CVE(s): CVE-2026-42946

SECURITY UPDATE: excessive memory allocation or over-read in scgi and uwsgi status line parsing - debian/patches/CVE-2026-42946.patch: excessive memory allocation or over-read in scgi and uwsgi status line parsing - CVE-2026-42946...

SUSE SLES15 Security Update : nginx (SUSE-SU-2026:2370-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2370-1 advisory. This update for nginx fixes the following issues - CVE-2026-9256: heap buffer overflow in the ngxhttprewritemodule when using a...