Nginx security vulnerabilities
Nginx and adjacent web-server records from the public feeds.
Built for Security and operations teams.
110 public records · 1 security-fix timeline events.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 3
- High 13
- Medium 5
- Low 1
2026-07-2122 issues2026-10-18
Known exploited
View all known exploited- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.Patch nowKEVEPSS 3.40%May 13, 2026
- Critical9.8Nginx UI is a web user interface for the Nginx web server.Patch nowKEVEPSS 2.52%Mar 30, 2026
- High8.6Kan is an open-source project management tool.Patch nowKEVEPSS 1.74%Mar 19, 2026
- Critical9.8Nginx UI is a web user interface for the Nginx web server.Patch nowKEVEPSS 1.01%Mar 5, 2026
Recently published
Browse catalog- High8.1Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing CredentialsCheck if you run itEPSS 0.50%Oct 15, 2026
- High8.3Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rCheck if you run itEPSS 0.18%Oct 14, 2026
- High8.7Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAutCheck if you run itEPSS 0.36%Oct 14, 2026
- High8.3Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the builtCheck if you run itEPSS 0.20%Oct 14, 2026
- Medium6.9Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanuCheck if you run itEPSS 0.32%Oct 14, 2026
- Medium6.9NGINX ngx_http_v3_module vulnerabilityCheck if you run itEPSS 0.25%Oct 14, 2026
- High8.7An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the policy or Ingress external authentication.Check if you run itEPSS 0.39%Oct 14, 2026
- High7.1Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent.Check if you run itEPSS 0.26%Oct 14, 2026
- High8.8Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unCheck if you run itEPSS 0.48%Oct 14, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.Check if you run itEPSS 0.44%Oct 14, 2026