GO-2026-6540 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition in github.com/lucasdillmann/nginx-ignition. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2026-102334: Improper Restriction of Excessive Authentication Attempts

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-102335: Incorrect Authorization

Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...

Medium: nginx

Issue Overview: NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a...

GPEWebDefender

GPEWebDefender A web-attack monitor. It sits next to nginx / Caddy / the app, tails access logs, and tells you when a site is being probed or exploited. If this process dies, the site keeps serving. It is not Wazuh, not OSSEC, and not a WAF. The command is gpewebdefender. Hosts, tokens, map pins,...

CVE-2026-90439 vulnerabilities

Vulnerabilities for packages: nginx-stable...

GHSA-FJGW-PMCM-G7J7 vulnerabilities

Vulnerabilities for packages: nginx-stable...

CVE-2026-90439 vulnerabilities

Vulnerabilities for packages: nginx-stable...

GHSA-FJGW-PMCM-G7J7 vulnerabilities

Vulnerabilities for packages: nginx-stable...

CVE-2026-100717

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

CVE-2026-100717

The froxlor server administration panel (versions 2.3.10 and earlier ) contains a CRLF injection vulnerability. The Validate::validateUrl component fails to inspect the userinfo (user:pass@) portion of a URL for carriage return and line feed characters. An authenticated low-privilege customer wit...

CVE-2026-100717 froxlor before 2.3.12 CRLF Injection via validateUrl userinfo

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

CVE-2026-100717 froxlor before 2.3.12 CRLF Injection via validateUrl userinfo

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

CVE-2026-100717 froxlor before 2.3.12 CRLF Injection via validateUrl userinfo

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

BIT-NGINX-GATEWAY-2026-90439 NGINX ngx_http_v3_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner th...

BIT-NGINX-2026-90439 NGINX ngx_http_v3_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner th...

Ingress-Nginx Controller - Remote Code Execution

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...

PT-2026-99002

NGINX Plus and NGINX Open Source have a vulnerability in the ngx http v3 module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner...

PT-2026-99001

NGINX Plus and NGINX Open Source have a vulnerability in the ngx http v3 module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner...

Linux Distros Unpatched Vulnerability : CVE-2026-61630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused...