267461 matches found
CVE-2026-107807 Nginx UI: Node Secret Credential Exposure via URL Query Parameter
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...
GO-2026-6610 vulnerabilities
Vulnerabilities for packages: k8sgateway-fips, crossplane-provider-aws-efs, gcp-compute-persistent-disk-csi-driver, metacontroller-fips, kured, goldilocks-fips, crossplane-provider-aws-codepipeline-fips, yace-fips, pyrra, influxd-fips, agentbeat, virt-handler, crossplane-provider-aws-gamelift-fip...
GO-2026-6611 vulnerabilities
Vulnerabilities for packages: k8sgateway-fips, crossplane-provider-aws-efs, gcp-compute-persistent-disk-csi-driver, metacontroller-fips, kured, goldilocks-fips, crossplane-provider-aws-codepipeline-fips, yace-fips, pyrra, influxd-fips, agentbeat, virt-handler, grafana-mysql-datasource,...
GO-2026-6617 vulnerabilities
Vulnerabilities for packages: k8sgateway-fips, crossplane-provider-aws-efs, gcp-compute-persistent-disk-csi-driver, metacontroller-fips, kured, goldilocks-fips, crossplane-provider-aws-codepipeline-fips, yace-fips, pyrra, influxd-fips, agentbeat, virt-handler, grafana-mysql-datasource,...
GO-2026-6603 vulnerabilities
Vulnerabilities for packages: k8sgateway-fips, crossplane-provider-aws-efs, gcp-compute-persistent-disk-csi-driver, metacontroller-fips, kured, goldilocks-fips, crossplane-provider-aws-codepipeline-fips, yace-fips, pyrra, influxd-fips, agentbeat, virt-handler, grafana-mysql-datasource,...
CVE-2026-78669 vulnerabilities
Vulnerabilities for packages: k8sgateway-fips, crossplane-provider-aws-efs, gcp-compute-persistent-disk-csi-driver, metacontroller-fips, kured, goldilocks-fips, crossplane-provider-aws-codepipeline-fips, yace-fips, pyrra, influxd-fips, agentbeat, virt-handler, grafana-mysql-datasource,...
GO-2026-6612 vulnerabilities
Vulnerabilities for packages: k8sgateway-fips, crossplane-provider-aws-efs, gcp-compute-persistent-disk-csi-driver, metacontroller-fips, kured, goldilocks-fips, crossplane-provider-aws-codepipeline-fips, yace-fips, pyrra, influxd-fips, agentbeat, virt-handler, grafana-mysql-datasource,...
GO-2026-6610 vulnerabilities
Vulnerabilities for packages: dockerize, kubernetes-csi-external-health-monitor, thanos, crossplane-provider-azure-sql, nats-server, rclone, boring-registry, syft, k8ssandra-operator, kaf, headlamp, crossplane-provider-aws-cloudformation, crossplane-provider-aws-cloudfront,...
GO-2026-6617 vulnerabilities
Vulnerabilities for packages: terraform-provider-sendgrid, dockerize, undock, kubernetes-csi-external-health-monitor, thanos, kubeflow-katib, crossplane-provider-azure-sql, nats-server, rclone, boring-registry, syft, k8ssandra-operator, kaf, headlamp, kserve-rest-proxy,...
CVE-2026-97032 vulnerabilities
Vulnerabilities for packages: terraform-provider-sendgrid, dockerize, undock, kubernetes-csi-external-health-monitor, thanos, kubeflow-katib, crossplane-provider-azure-sql, nats-server, rclone, boring-registry, syft, k8ssandra-operator, kaf, headlamp, kserve-rest-proxy,...
CVE-2026-107805
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...
CVE-2026-107805
The Nginx UI web user interface is vulnerable to a resource exhaustion flaw in versions 2.5.0 through 2.6.0 . The root cause lies in the node-signature authentication path , which stages an attacker-controlled request body into a temporary file and synchronizes it before validating the cryptograp...
CVE-2026-107805 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...
EUVD-2026-95818
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...
CVE-2026-107805 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...
ROOT-APP-NPM-AIKIDO-2026-10823 AIKIDO-2026-10823 in axios - Patched by Root
Root has patched AIKIDO-2026-10823 in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-42043 CVE-2026-42043 in axios - Patched by Root
Root has patched CVE-2026-42043 in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-42037 CVE-2026-42037 in axios - Patched by Root
Root has patched CVE-2026-42037 in the axios package for Root:npm. Multiple fixed versions available...