7942 matches found
CVE-2026-18329: Not Failing Securely
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
MiracleLinux 9 : nginx-1.20.1-28.el9_8.5.ML.1 (AXSA:2026-1735:07)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1735:07 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of...
njs -- heap buffer overflow in XML exclusive canonicalization
F5 reports: A flaw in the NGINX JavaScript XML module allows an out-of-bounds write when xml.exclusiveC14n processes a crafted XML namespace prefix list. This may lead to worker process crashes, heap corruption or memory disclosure. The NGINX SAML reference implementation is affected because it...
PT-2026-84760
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...
CVE-2026-78222: NULL Pointer Dereference
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...
bunkerweb v1.6.15-rc1
🌐 Website | 🤝 Panel | 📓 Documentation | 👨💻 Demo | 📱 Demo UI | 🧩 Templates | 🛡️ Examples 💬 Chat | 📝 Forum | 📝 Community | 🗺️ Threatmap | 📊 Status | 🔎 Feedback 🛡️ Make security by default great again! BunkerWeb Bun...
CLEANSTART-2026-BE65099 Security fixes in nginx-prometheus-exporter-fips 1.5.3-r1
Package nginx-prometheus-exporter-fips version 1.5.3-r1 fixes 8 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853...
MiracleLinux 9 : nginx:1.24 (AXSA:2026-1718:01)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1718:01 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of...
MiracleLinux 9 : nginx:1.26 (AXSA:2026-1722:01)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1722:01 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of...
AlmaLinux 9 : nginx:1.26 (ALSA-2026:59496)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:59496 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of service ...
CVE-2026-75594 Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...
cve-analysis-exploitation-mitigation
CVE Analysis, Exploitation & Mitigation A hands-on cybersecur...
CVE-2026-80208 APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints
APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxi...
MiracleLinux 8 : nginx:1.24 (AXSA:2026-1679:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1679:01 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of...
CVE-2026-80208: Missing Authentication for Critical Function
APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxi...
RLSA-2026:59362 Important: nginx security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial o...
nginx security update
An update is available for nginx. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list nginx is a web and proxy server supporting HTTP and other protocols, with a foc...
RHSA-2026:59490 Red Hat Security Advisory: nginx:1.24 security update
Bulletin has no description...