{"kind": "product", "path": "vulns/debian-13/nginx", "name": "nginx", "product": "nginx", "ecosystem": "Debian:13", "items": [{"id": "CVE-2026-95101", "noindex": false, "published": "2026-10-14T14:40:28.955Z", "modified": "2026-10-15T16:43:46.630Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00247, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-95101", "title": "NGINX ngx_http_v3_module vulnerability", "description": "Description\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with \n\nproxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.\n\nImpact\n\n\nThis vulnerability may allow remote attackers to \n\ninject data in the proxied request.  There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000162613", "https://nvd.nist.gov/vuln/detail/CVE-2026-95101"], "fixes": ["1.26.3-3+deb13u10"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-97205", "noindex": false, "published": "2026-10-14T14:40:27.487Z", "modified": "2026-10-15T10:31:15.547Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00484, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-97205", "title": "NGINX ngx_http_core_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or po", "references": ["https://my.f5.com/manage/s/article/K000162608", "https://nvd.nist.gov/vuln/detail/CVE-2026-97205"], "fixes": ["1.26.3-3+deb13u10"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-93479", "noindex": false, "published": "2026-10-14T14:40:27.107Z", "modified": "2026-10-23T21:51:37.287Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00554, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-93479", "title": "NGINX map directive and regex matching vulnerability", "description": "A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Addr", "references": ["https://my.f5.com/manage/s/article/K000162607", "https://nvd.nist.gov/vuln/detail/CVE-2026-93479"], "fixes": ["1.26.3-3+deb13u10"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-97629", "noindex": false, "published": "2026-10-14T14:40:26.740Z", "modified": "2026-10-15T16:43:47.036Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00175, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-97629", "title": "NGINX ngx_http_ssl_module vulnerability", "description": "Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane ex", "references": ["https://my.f5.com/manage/s/article/K000162606", "https://nvd.nist.gov/vuln/detail/CVE-2026-97629"], "fixes": ["1.26.3-3+deb13u10"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-15176", "noindex": false, "published": "2026-10-14T14:40:26.374Z", "modified": "2026-10-15T10:31:15.809Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00516, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-15176", "title": "NGINX ngx_http_core_module vulnerability", "description": "A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Rando", "references": ["https://my.f5.com/manage/s/article/K000162416", "https://nvd.nist.gov/vuln/detail/CVE-2026-15176"], "fixes": ["1.26.3-3+deb13u10"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-60005", "noindex": false, "published": "2026-07-15T15:04:21.040Z", "modified": "2026-07-15T15:41:06.279Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00531, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-60005", "title": "NGINX ngx_http_slice_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\nImpact:\nThis vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.\nNote: The ngx_http_slice_module module is not ena", "references": ["https://my.f5.com/manage/s/article/K000162100", "https://nvd.nist.gov/vuln/detail/CVE-2026-60005"], "fixes": ["1.26.3-3+deb13u8"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-56434", "noindex": false, "published": "2026-07-15T14:33:46.142Z", "modified": "2026-07-15T18:10:54.402Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00419, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-56434", "title": "NGINX ngx_http_ssi_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.\n\nImpact:\nThis vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker ", "references": ["https://my.f5.com/manage/s/article/K000162098", "https://nvd.nist.gov/vuln/detail/CVE-2026-56434"], "fixes": ["1.26.3-3+deb13u8"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-42533", "noindex": false, "published": "2026-07-15T14:33:45.810Z", "modified": "2026-07-29T03:55:24.843Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00894, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-42533", "title": "NGINX Map directive and Regex matching vulnerability", "description": "A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Ran", "references": ["https://my.f5.com/manage/s/article/K000162097", "https://nvd.nist.gov/vuln/detail/CVE-2026-42533"], "fixes": ["1.26.3-3+deb13u8"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-48142", "noindex": false, "published": "2026-06-17T14:04:32.856Z", "modified": "2026-06-17T15:42:56.704Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00373, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-48142", "title": "NGINX ngx_http_charset_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000161585", "https://nvd.nist.gov/vuln/detail/CVE-2026-48142"], "fixes": ["1.26.3-3+deb13u7"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-42055", "noindex": false, "published": "2026-06-17T14:04:32.520Z", "modified": "2026-09-14T12:04:28.530Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.06537, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-42055", "title": "NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on sys", "references": ["https://my.f5.com/manage/s/article/K000161584", "https://access.redhat.com/security/cve/CVE-2026-42055", "https://bugzilla.redhat.com/show_bug.cgi?id=2489866"], "fixes": ["1.26.3-3+deb13u7"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-9256", "noindex": false, "published": "2026-05-22T14:11:41.877Z", "modified": "2026-08-25T12:05:55.163Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.02697, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-9256", "title": "NGINX ngx_http_rewrite_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute co", "references": ["https://my.f5.com/manage/s/article/K000161377", "http://www.openwall.com/lists/oss-security/2026/05/22/14", "https://lists.debian.org/debian-lts-announce/2026/06/msg00023.html"], "fixes": ["1.26.3-3+deb13u6"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-40460", "noindex": false, "published": "2026-05-13T14:12:45.291Z", "modified": "2026-05-13T16:06:43.631Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00384, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-40460", "title": "NGINX ngx_quic_module vulnerability", "description": "When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000161068", "https://nvd.nist.gov/vuln/detail/CVE-2026-40460"], "fixes": ["1.26.3-3+deb13u5"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-42946", "noindex": false, "published": "2026-05-13T14:12:44.697Z", "modified": "2026-05-13T16:06:56.898Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00932, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-42946", "title": "NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability", "description": "A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000161027", "https://nvd.nist.gov/vuln/detail/CVE-2026-42946"], "fixes": ["1.26.3-3+deb13u6"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-42934", "noindex": false, "published": "2026-05-13T14:12:44.331Z", "modified": "2026-06-08T20:34:05.147Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00731, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-42934", "title": "NGINX ngx_http_charset_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000161028", "https://nvd.nist.gov/vuln/detail/CVE-2026-42934"], "fixes": ["1.26.3-3+deb13u5"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-42945", "noindex": false, "published": "2026-05-13T14:12:43.971Z", "modified": "2026-09-10T12:04:53.533Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.03396, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-42945", "title": "NGINX ngx_http_rewrite_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomiza", "references": ["https://my.f5.com/manage/s/article/K000161019", "https://depthfirst.com/nginx-rift", "https://github.com/DepthFirstDisclosures/Nginx-Rift"], "fixes": ["1.26.3-3+deb13u5"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-40701", "noindex": false, "published": "2026-05-13T14:12:43.588Z", "modified": "2026-05-13T16:07:37.463Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0069, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-40701", "title": "NGINX ngx_http_ssl_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to \"on\" or \"optional,\" and the ssl_ocsp directive is set to \"on\" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000161021", "https://nvd.nist.gov/vuln/detail/CVE-2026-40701"], "fixes": ["1.26.3-3+deb13u5"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-27651", "noindex": false, "published": "2026-03-24T14:13:27.295Z", "modified": "2026-07-15T01:13:39.490Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.01707, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-27651", "title": "NGINX ngx_mail_auth_http_module vulnerability", "description": "When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000160383", "https://access.redhat.com/security/cve/CVE-2026-27651", "https://bugzilla.redhat.com/show_bug.cgi?id=2450791"], "fixes": ["1.26.3-3+deb13u3"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-27654", "noindex": false, "published": "2026-03-24T14:13:26.879Z", "modified": "2026-07-15T01:13:37.047Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.25942, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-27654", "title": "NGINX ngx_http_dav_module vulnerability", "description": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access t", "references": ["https://my.f5.com/manage/s/article/K000160382", "https://access.redhat.com/security/cve/CVE-2026-27654", "https://bugzilla.redhat.com/show_bug.cgi?id=2450776"], "fixes": ["1.26.3-3+deb13u3"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-28753", "noindex": false, "published": "2026-03-24T14:13:26.107Z", "modified": "2026-03-24T15:24:34.995Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00275, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-28753", "title": "NGINX ngx_mail_proxy_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000160367", "https://nvd.nist.gov/vuln/detail/CVE-2026-28753"], "fixes": ["1.26.3-3+deb13u3"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-32647", "noindex": false, "published": "2026-03-24T14:13:25.724Z", "modified": "2026-07-15T01:07:50.616Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00358, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-32647", "title": "NGINX ngx_http_mp4_module vulnerability", "description": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. \n\n\nNote: Software versions which have reached End of T", "references": ["https://my.f5.com/manage/s/article/K000160366", "https://access.redhat.com/security/cve/CVE-2026-32647", "https://bugzilla.redhat.com/show_bug.cgi?id=2449598"], "fixes": ["1.26.3-3+deb13u3"], "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}]}], "total": 71, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "nginx", "path": "vulns/debian-13/nginx", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 5, "kev": 0}, "lastmod": "2026-10-23T21:51:37.287Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}