8503 matches found
SUSE CVE-2026-33031
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user's access, so an...
SUSE CVE-2026-34403
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking CSWSH. Combined with the fact that authentication tokens...
SUSE CVE-2026-34457
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an authrequest-style integration such as nginx authrequest and either...
SUSE CVE-2026-42220
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired through the X-Node-Secret header or nodesecret...
SUSE CVE-2026-42221
Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable...
SUSE CVE-2026-42222
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available...
SUSE CVE-2026-42223
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler api/settings/settings.go:24-65 serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with protected:"true" - however, this tag...
SUSE CVE-2026-42238
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint POST /api/restore that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can...
SUSE CVE-2026-44015
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...
CLEANSTART-2026-YT08737 Security fixes in nginx-prometheus-exporter 1.5.1-r2
Package nginx-prometheus-exporter version 1.5.1-r2 fixes 21 vulnerabilities: CVE-2026-27143, CVE-2026-27140, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...
CLEANSTART-2026-AW13748 Security fixes in ingress-nginx-controller-1.15 1.15.1-r3
Package ingress-nginx-controller-1.15 version 1.15.1-r3 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2026-39822, CVE-2026-42505...
CLEANSTART-2026-XZ21760 Security fixes in nginx-prometheus-exporter 1.5.1-r0
Package nginx-prometheus-exporter version 1.5.1-r0 fixes 7 vulnerabilities: CVE-2025-61726, CVE-2025-61729, CVE-2025-61728, CVE-2025-61731, CVE-2025-61731...
CLEANSTART-2026-DI60176 Security fixes in nginx 1.22.1-r0
Package nginx version 1.22.1-r0 fixes 2 vulnerabilities: CVE-2022-41741, CVE-2022-41742...
CLEANSTART-2026-QI11892 Security fixes in nginx 1.14.1-r0
Package nginx version 1.14.1-r0 fixes 3 vulnerabilities: CVE-2018-16843, CVE-2018-16844, CVE-2018-16845...
CLEANSTART-2026-KL00437 Security fixes in ingress-nginx-controller-1.12 1.12.8-r0
Package ingress-nginx-controller-1.12 version 1.12.8-r0 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2024-55549, CVE-2025-24855...
CLEANSTART-2026-CW84723 Security fixes in ingress-nginx-controller-1.14 1.14.5-r3
Package ingress-nginx-controller-1.14 version 1.14.5-r3 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2024-55549, CVE-2025-24855...
CLEANSTART-2026-TQ49781 Security fixes in ingress-nginx-controller-1.15 1.15.1-r2
Package ingress-nginx-controller-1.15 version 1.15.1-r2 fixes 3 vulnerabilities: CVE-2026-42504, CVE-2026-27145, CVE-2026-42507...
CLEANSTART-2026-SL54475 Security fixes in nginx 1.16.1-r0
Package nginx version 1.16.1-r0 fixes 3 vulnerabilities: CVE-2019-9511, CVE-2019-9513, CVE-2019-9516...