CVE-2026-34403

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking CSWSH. Combined with the fact that authentication tokens...

CVE-2026-42926

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxyhttpversion to 2, and also uses proxysetbody, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2026-9508

Incorrect permission settings on a critical resource in Suprema BioStar 2 versions 2.9.3 through 2.9.11 that allow backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. This vulnerability allows an attacker with network access to directly...

CVE-2026-33031

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an...

CVE-2026-8711

NGINX JavaScript has a vulnerability when the jsfetchproxy directive is configured with at least one client-controlled NGINX variable for example, $http, $arg, $cookie and a location invoking the ngx.fetch operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability...

Imperva Customers Protected Against CVE-2026-49975 (HTTP/2 Bomb) DoS

TL;DR: CVE-2026-49975, dubbed the “HTTP/2 Bomb,” is a critical remote Denial-of-Service DoS vulnerability affecting default HTTP/2 configurations of major web servers including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. Discovered by security firm Calif using OpenAI’s Code...

Exploit for CVE-2026-42945

nginx-rift-scanner Dependency-free Python 3 scanner for CVE...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : nginx vulnerabilities (USN-8375-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8375-1 advisory. It was discovered that the nginx ngxmailsmtpmodule module incorrectly handled certain memory operations when doing SM...

RockyLinux 10 : nginx (RLSA-2026:19159)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:19159 advisory. nginx: NGINX: Arbitrary Code Execution Vulnerability CVE-2026-42945 Tenable has extracted the preceding description block directly from the RockyLinux security...

New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare

Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The vulnerability has been codenamed HTTP/2 Bomb by Calif. "The vulnerable behavior exists in each server's...

CVE-2026-9256 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

GHSA-H78R-86C6-JGP4 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

GHSA-H78R-86C6-JGP4 vulnerabilities

Vulnerabilities for packages: nginx-mainline, nginx-stable...

CVE-2026-9256 vulnerabilities

Vulnerabilities for packages: nginx-mainline, nginx-stable...

Exploit for CVE-2026-9256

CVE-2026-9...

RockyLinux 9 : nginx:1.24 (RLSA-2026:19371)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:19371 advisory. nginx: NGINX: Arbitrary Code Execution Vulnerability CVE-2026-42945 Tenable has extracted the preceding description block directly from the RockyLinux security...

May Linux Patch Wednesday

May Linux Patch Wednesday. A total of 1,638 vulnerabilities 474 in the Linux kernel. For comparison, in April there were 1,035 vulnerabilities a record!. And this time it turns out to be a record again, more than one and a half times higher! The acceleration is both impressive and alarming. But w...

Critical: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.33 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.14.33 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.14.33 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-6993: RHODF 4.14.33 release NGINX: Arbitrary Code Execution Vulnerability CVE-2026-42945...

Critical: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.29 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.16.29 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.16.29 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7034: RHODF 4.16.29 release NGINX: Arbitrary Code Execution Vulnerability CVE-2026-42945...

Critical: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.15.29 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.15.29 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.15.29 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-6992: RHODF 4.15.29 release NGINX: Arbitrary Code Execution Vulnerability CVE-2026-42945...