K000162613: NGINX ngx_http_v3_module vulnerability CVE-2026-95101

Security Advisory Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. CVE-2026-95101 Impact This vulnerability may...

K000162610: NGINX Gateway Fabric vulnerability CVE-2026-96615

Security Advisory Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition CRD and has an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticate...

K000162609: NGINX Gateway Fabric vulnerability CVE-2026-91184

Security Advisory Description NGINX Gateway Fabric has a vulnerability when it renders spec.basic.realm and spec.jwt.realm of a namespaced AuthenticationFilter Custom Resource Definition CRD verbatim, unescaped and unvalidated, into the shared data plane nginx.conf as authbasic "";. A namespaced...

K000162607: NGINX map directive and regex matching vulnerability CVE-2026-93479

Security Advisory Description A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result cou...

K000162606: NGINX ngx_http_ssl_module vulnerability CVE-2026-97629

Security Advisory Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared: : without an explicit sslsessionticketkey file directive to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a...

K000162416: NGINX ngx_http_core_module vulnerability CVE-2026-15176

Security Advisory Description A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when...

CVE-2026-101025: Missing Release of Memory after Effective Lifetime

Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with...

PT-2026-114364

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description When configured with ssl session cache shared:name:size without explicit ssl session ticket key file directives for automatic rotation of...

CVE-2026-96615: Authentication Bypass by Spoofing

Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition CRD and have an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticated NGINX Agent gRP...

CVE-2026-91184: Improper Neutralization of Equivalent Special Elements

Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as authbasic " ";. A namespaced authenticated attacker that configures...

CVE-2026-102748: Missing Authentication for Critical Function

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to...

CVE-2026-102051: Missing Release of Memory after Effective Lifetime

An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast...

CVE-2026-102050: Stack-based Buffer Overflow

A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated...

CVE-2026-102980: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...

Linux Distros Unpatched Vulnerability : CVE-2026-97629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to...

Linux Distros Unpatched Vulnerability : CVE-2026-97205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations,...

PT-2026-114359

Name of the Vulnerable Software and Affected Versions NGINX Gateway Fabric affected versions not specified Description An issue exists when the software is configured with the Gateway Custom Resource Definition CRD and maintains an authenticated gRPC connection with the NGINX Agent. A namespaced...

CVE-2026-104939: Incorrect Implementation of Authentication Algorithm

Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external...

PT-2026-113950

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description Missing object-level authorization checks allow for membership disruption and cross-member preference tampering. In the ProjectMemberViewSet.partial update function, authorization checks are incorrectl...

PT-2026-114333

Name of the Vulnerable Software and Affected Versions NGINX Gateway Fabric affected versions not specified Description An issue exists when the software renders the spec.basic.realm and spec.jwt.realm fields of a namespaced AuthenticationFilter into the shared data-plane nginx.conf. Because these...