Critical Photon OS Security Update - PHSA-2026-5.0-92-0935

Updates of 'linux-esx', 'erlang', 'nginx', 'go', 'linux', 'libsolv' packages of Photon OS have been released...

SUSE CVE-2026-33031

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user's access, so an...

SUSE CVE-2026-34403

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking CSWSH. Combined with the fact that authentication tokens...

SUSE CVE-2026-34457

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an authrequest-style integration such as nginx authrequest and either...

SUSE CVE-2026-42220

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired through the X-Node-Secret header or nodesecret...

SUSE CVE-2026-42221

Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable...

SUSE CVE-2026-42222

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available...

SUSE CVE-2026-42223

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler api/settings/settings.go:24-65 serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with protected:"true" - however, this tag...

SUSE CVE-2026-42238

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint POST /api/restore that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can...

SUSE CVE-2026-44015

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...

CLEANSTART-2026-RF39615 Security fixes in nginx 1.24.0-r12

Package nginx version 1.24.0-r12 fixes 1 vulnerabilities: CVE-2023-44487...

CLEANSTART-2026-CT53141 Security fixes in ingress-nginx-controller-1.14 1.14.5-r2

Package ingress-nginx-controller-1.14 version 1.14.5-r2 fixes 2 vulnerabilities: CVE-2026-45186, CVE-2026-41080...

CLEANSTART-2026-VY82100 Security fixes in ingress-nginx-controller-1.12 1.14.5-r2

Package ingress-nginx-controller-1.12 version 1.14.5-r2 fixes 2 vulnerabilities: CVE-2026-45186, CVE-2026-41080...

CLEANSTART-2026-KL00437 Security fixes in ingress-nginx-controller-1.12 1.12.8-r0

Package ingress-nginx-controller-1.12 version 1.12.8-r0 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2024-55549, CVE-2025-24855...

CLEANSTART-2026-ZL14061 Security fixes in nginx 1.20.1-r0

Package nginx version 1.20.1-r0 fixes 1 vulnerabilities: CVE-2021-23017...

CLEANSTART-2026-QY68123 Security fixes in nginx 1.16.1-r6

Package nginx version 1.16.1-r6 fixes 1 vulnerabilities: CVE-2019-20372...

CLEANSTART-2026-EM10035 Security fixes in nginx 1.20.1-r1

Package nginx version 1.20.1-r1 fixes 1 vulnerabilities: CVE-2021-3618...

CLEANSTART-2026-CW84723 Security fixes in ingress-nginx-controller-1.14 1.14.5-r3

Package ingress-nginx-controller-1.14 version 1.14.5-r3 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2024-55549, CVE-2025-24855...

CLEANSTART-2026-QV63914 Security fixes in ingress-nginx-controller 1.24.2-r0

Package ingress-nginx-controller version 1.24.2-r0 fixes 9 vulnerabilities: CVE-2025-22871, CVE-2025-4673, CVE-2024-45341, CVE-2024-45336, CVE-2025-0913...

CLEANSTART-2026-WO51629 Security fixes in ingress-nginx-controller-1.12 1.14.5-r1

Package ingress-nginx-controller-1.12 version 1.14.5-r1 fixes 10 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507, CVE-2026-39824, CVE-2026-25681...