Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Critical9.2A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return direct…EPSS 0.5%Oct 14, 2026
- High8.7Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAutEPSS 0.4%Oct 14, 2026
- High8.3Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the builtEPSS 0.2%Oct 14, 2026
- Medium6.9Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanuEPSS 0.3%Oct 14, 2026
- Medium6.9NGINX ngx_http_v3_module vulnerabilityEPSS 0.2%Oct 14, 2026
- High8.7An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the policy or Ingress external authentication.EPSS 0.4%Oct 14, 2026
- High7.1Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent.EPSS 0.3%Oct 14, 2026
- High8.8Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unEPSS 0.5%Oct 14, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.EPSS 0.4%Oct 14, 2026
- Critical9.2NGINX map directive and regex matching vulnerabilityEPSS 0.6%Oct 14, 2026
- Critical9.3F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityKEVEPSS 2.2%Sep 22, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.May 22, 2026
- Critical9.2NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*,…May 19, 2026
- High8.3A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.May 13, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.May 13, 2026
- High7.1Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST.May 13, 2026
- Medium6.3NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.May 13, 2026
- High8.5When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.May 13, 2026
- Medium6.3When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame…May 13, 2026
- High8.5An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation.May 13, 2026
- High8.7When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM…May 13, 2026
- High7.1A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges.May 13, 2026
- High7.1When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management M…May 13, 2026
- Medium6.9A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitra…May 13, 2026
- High8.7When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traff…May 13, 2026
90 records · page 1 of 4
PreviousNext