gixy

GIXY Overview Gixy is a tool to analyze Nginx configuration. The main goal of Gixy is to prevent security misconfiguration and automate flaw detection. Currently supported Python versions are 2.7, 3.5, 3.6 and 3.7. Disclaimer: Gixy is well tested only on GNU/Linux, other OSs may have some issues...

Gixy-Next

Gixy-Next: NGINX Configuration Security Scanner for Security Audits Overview Gixy-Next Gixy is an open-source NGINX configuration security scanner and hardening tool that statically analyzes your nginx.conf to detect security misconfigurations, hardening gaps, and common performance pitfalls befo...

EUVD-2026-97908

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

stop-bots

Stop Bots A TUI, a web console and a CLI that help you configure your server to stop bad bots without hiding behind a CDN. It works alongside NGINX and your existing firewall nftables or iptables: NGINX config. - It classifies known bots by category scanners, search engines, AI crawlers and block...

nginxconfig.io

⚙️ NGINX configuration generator on steroids 💉 The only tool you'll ever need to configure your NGINX server. do.co/nginxconfig » Report a bug · Request a feature ✨ NGINX Config NGINX is so much more than just a webserver. You already knew that, probably. We love NGINX, because: Low memory usage...

cve-2026-42945-scan

cve-2026-42945-scan Static scanner for NGINX configuration files that detects the rewrite/set pattern associated with CVE-2026-42945. The scanner parses NGINX configs with crossplane, walks location blocks, and prints every location that looks affected in this format: //xxx.conf: - location XXXXX...

gixy

GIXY Resumen Gixy es una herramienta para analizar la configuración de Nginx. El objetivo principal de Gixy es prevenir configuraciones de seguridad incorrectas y automatizar la detección de fallos. Actualmente, las versiones de Python compatibles son 2.7, 3.5, 3.6 y 3.7. Aviso: Gixy ha sido...

cve-2025-4615

CVE-2025-4615 — Technical Analysis & Proof of Concept Vulnerability: Improper Neutralization of Input in PAN-OS Management Web Interface Vendor Advisory: https://security.paloaltonetworks.com/CVE-2025-4615 CVSS 4.0: 6.9 MEDIUM — Integrity HIGH, Availability HIGH CWE: CWE-83 Improper Neutralizatio...

Discourse Backup File Disclosure Via Default Nginx Configuration

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore--LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

CVE-2026-107809

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

EUVD-2026-95892

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...

CVE-2026-100717

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

CVE-2026-100717 froxlor before 2.3.12 CRLF Injection via validateUrl userinfo

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

CVE-2026-100717

The froxlor server administration panel (versions 2.3.10 and earlier ) contains a CRLF injection vulnerability. The Validate::validateUrl component fails to inspect the userinfo (user:pass@) portion of a URL for carriage return and line feed characters. An authenticated low-privilege customer wit...

Gixy-Next v0.7.1

Gixy-Next: NGINX Configuration Security Scanner for Security Audits Overview Gixy-Next Gixy is an open-source NGINX configuration security scanner and hardening tool that statically analyzes your nginx.conf to detect security misconfigurations, hardening gaps, and common performance pitfalls befo...

CVE-2026-88874 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

CVE-2026-78545 Improper Input Sanitization in Okta Access Gateway Application Label Configuration

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives...

CVE-2026-78545: Improper Control of Generation of Code

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives...

CVE-2026-66362: Improper Neutralization of Equivalent Special Elements

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...

CVE-2026-77180: Improper Neutralization of Equivalent Special Elements

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...