Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Low3.6ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the sa…EPSS 0.1%Oct 12, 2026
- Medium5.3Contao: Path traversal in the images controllerEPSS 0.3%Oct 9, 2026
- Medium4.2Authentication Bypass Using an Alternate Path or Channel in MalcolmEPSS 0.2%Oct 8, 2026
- Critical9.1UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Pr…EPSS 0.3%Sep 21, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.May 22, 2026
- Critical9.2NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*,…May 19, 2026
- Medium6.9Fleet is open source device management software.May 14, 2026
- High8.3A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.May 13, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.May 13, 2026
- Medium6.3NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.May 13, 2026
- Medium6.3When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame…May 13, 2026
- Medium6.3NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_…May 13, 2026
- Medium6.9When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of auth…May 13, 2026
- High8.7Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.May 13, 2026
- Critical9.9Nginx UI is a web user interface for the Nginx web server.May 12, 2026
- High8.2ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.May 12, 2026
- Critical9.2SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to…May 12, 2026
- High8.2ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.May 5, 2026
- Critical9.0Nginx UI is a web user interface for the Nginx web server.May 4, 2026
- Medium6.5Nginx UI is a web user interface for the Nginx web server.May 4, 2026
- Critical9.8Nginx UI is a web user interface for the Nginx web server.May 4, 2026
- Critical9.8Nginx UI is a web user interface for the Nginx web server.May 4, 2026
- Medium6.5Nginx UI is a web user interface for the Nginx web server.May 4, 2026
- Critical9.1Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.Apr 29, 2026
- High7.4Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.Apr 24, 2026