Technology hubs

Nginx

Nginx and adjacent web-server records from the public feeds.

Explore Nginx vulnerabilities Monitor My Technology Stack

89 public records currently classified under this stack.

Recent Nginx findings

High8.1The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of…CVE-2026-75903 · CVE.org · NIST NVD · nginx, WordPressOct 16, 2026
High8.8The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7…CVE-2026-92553 · CVE.org · NIST NVD · nginx, WordPressOct 16, 2026
High8.3Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to au…CVE-2026-97629 · CVE.org · FIRST EPSS · NIST NVD · nginxEPSS 0.2%Oct 14, 2026
Critical9.2A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return direct…CVE-2026-15176 · Canadian Centre for Cyber Security · CVE.org · FIRST EPSS · F5, nginxEPSS 0.5%Oct 14, 2026
High8.7Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAutCVE-2026-104939 · F5 · NGINX Ingress Controller · Canadian Centre for Cyber Security · CIRCL Vulnerability Lookup · CVE.org · F5, nginxEPSS 0.4%Oct 14, 2026
High8.3Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the builtCVE-2026-101019 · F5 · NGINX JavaScript · Canadian Centre for Cyber Security · CIRCL Vulnerability Lookup · CVE.org · F5, nginxEPSS 0.2%Oct 14, 2026
Medium6.9Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanuCVE-2026-101025 · F5 · NGINX JavaScript · CIRCL Vulnerability Lookup · CVE.org · FIRST EPSS · F5, nginxEPSS 0.3%Oct 14, 2026
Medium6.9NGINX ngx_http_v3_module vulnerabilityCVE-2026-95101 · F5 · NGINX Plus · CIRCL Vulnerability Lookup · CVE.org · FIRST EPSS · F5, nginxEPSS 0.2%Oct 14, 2026
High8.7An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the policy or Ingress external authentication.CVE-2026-94197 · F5 · NGINX Ingress Controller · CIRCL Vulnerability Lookup · CVE.org · FIRST EPSS · F5, nginxEPSS 0.4%Oct 14, 2026
High7.1Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent.CVE-2026-96615 · F5 · NGINX Gateway Fabric · CIRCL Vulnerability Lookup · CVE.org · FIRST EPSS · F5, nginxEPSS 0.3%Oct 14, 2026