Nginx
Monthly
Vulnity Security, a WordPress plugin maintained by Manuel Galan, can be bypassed to gain administrator access on Nginx-based installations running version 1.4.3 or earlier. The plugin's delegated-login feature writes a pairing credential file and auto-generates an Nginx configuration snippet intended to block web access to it, but the snippet guards the wrong directory path, leaving the credential file reachable by unauthenticated attackers who can then forge signed REST API requests and authenticate as an administrator. No public exploit code or confirmed active exploitation was identified at time of analysis, but the attack requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), with High complexity arising from the dependency on a qualifying Nginx deployment where the delegated-login pairing credential exists and the flawed snippet is active; Apache and other web servers appear unaffected.
Remote code execution via arbitrary file upload affects the YaySMTP WordPress plugin in all versions up to and including 2.7.7, where an authenticated subscriber-level user can upload executable files through the putFile function. The plugin relies on sanitize_file_name() without an allow-list, MIME check, or safe-extension rename, and its only server-side guard is a .htaccess file with 'Require all denied' that nginx and Apache with AllowOverride None ignore, so full RCE is achievable on those configurations. No public exploit code was identified at time of analysis and there is no confirmed CISA KEV active exploitation; exploitation requires authentication at subscriber level or above, which is commonly available when open user registration is enabled.
Authentication bypass in F5 NGINX Ingress Controller allows unauthenticated remote attackers to access protected paths when an externalAuth policy delegating to an OAuth identity provider is configured. The flaw is due to incorrect handling of the IdP's HTTP response (CWE-303), enabling access before proper authentication completes. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), it requires no privileges or user interaction, impacts confidentiality only, and is strictly a data plane issue with no control plane exposure. No public exploit has been identified at time of analysis; only deployments using externalAuth with OAuth are affected.
Canonicalization inconsistency in the NGINX JavaScript (njs) XML module lets an unauthenticated attacker who already holds a genuinely signed SAML/XML document cause entity-backed attributes to appear absent or truncated ($attr$Name returning undefined, $attrs derived from only the first attribute child) while signature verification still succeeds. nginx-saml running the built-in njs backend is the confirmed affected consumer, where this can bypass expiry, Destination, and request-correlation checks and enable replay or acceptance of a response outside its intended context; the flaw cannot forge signatures or identities and has no availability or control-plane impact. F5's advisory rates this 8.3 (High, CVSS 4.0 with AT:P reflecting the significant effort needed to obtain a validly signed document); no public exploit code was identified at time of analysis, and no KEV listing applies. There is no public exploit identified at time of analysis.
Unauthenticated, remote attackers can bypass authentication and reach protected paths in F5 NGINX Kubernetes Ingress Controller (NIC) deployments configured with the ExternalAuth policy or Ingress external authentication. The flaw (CWE-290, authentication bypass by spoofing) occurs because client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers are forwarded unsanitized into the internal NGINX auth_request subrequest, letting an attacker spoof the request attributes the external authentication provider evaluates; exploitation is remote, low-complexity and requires no authentication or user interaction, but is gated on the non-default external-auth configuration and is bounded to the data plane, affecting confidentiality/access only (no control plane exposure, no integrity or availability impact). No public exploit identified at time of analysis.
A namespaced authenticated attacker holding access to a Kubernetes service account can impersonate the NGINX Agent gRPC connection in NGINX Gateway Fabric and read TLS private keys belonging to Gateway deployments in other namespaces. Exploitation requires the Gateway Custom Resource Definition to be configured and an authenticated gRPC link between the control plane and NGINX Agent, making this an access-gated control-plane disclosure flaw with no data plane exposure. No public exploit code was identified at the time of analysis.
Directive injection in NGINX Gateway Fabric lets an authenticated namespaced tenant escape the auth_basic "<realm>"; quoting rendered into a shared data-plane nginx.conf and inject arbitrary NGINX directives. Exploitation requires a multi-tenant deployment in which several namespaces share one Gateway/data plane, plus namespaced RBAC to create an AuthenticationFilter CRD and attach it via spec.basic.realm or spec.jwt.realm to an HTTPRoute or GRPCRoute bound to that Gateway (CVSS vector shows PR:L and UI:N, so valid authenticated credentials are required and no user interaction is needed). The impact is control-plane only, with no data-plane exposure, but a successful attacker could read co-located tenants' mounted secrets, perform SSRF through proxy_pass, read the pod ServiceAccount token, or hijack other tenants' routes; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing 'include virtual' commands is processed, causing memory corruption or a worker process crash. This affects both NGINX Plus and NGINX Open Source, with code execution possible only on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration (AIO and SSI enabled), and no public exploit code was identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default map directive with regex matching is configured so that the root directive or access log format references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under specific conditions. The flaw is remotely reachable without authentication (CVSS PR:N) but has high attack complexity (AC:H) because exploitation depends on conditions beyond the attacker's control and on a non-default configuration; the realistic outcome on systems with ASLR enabled is worker-process restart/DoS, while code execution is limited to systems with ASLR disabled or bypassed. F5 rates this CVSS 4.0 9.2 (Critical), and no public exploit identified at time of analysis.
SSL session ticket key handling in NGINX Plus and NGINX Open Source can let a remote unauthenticated attacker forge client SSL sessions and bypass client certificate verification, but only on instances that enforce mutual TLS and rely on NGINX's automatic ticket key rotation. Exploitation is conditional and non-deterministic: the affected deployments must be configured with ssl_session_cache shared:name:size and must not set an explicit ssl_session_ticket_key file, and the resulting forgery is beyond the attacker's control (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, 6.5). There is confirmed data-plane information exposure potential but no control-plane exposure, and no public exploit identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through crafted HTTP requests, but only when a non-default configuration uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, or when $request_filename is used in an access log format directive. Successful exploitation causes a heap buffer overflow in the NGINX worker process, leading to a restart (denial of service) and potentially allowing code execution on systems with ASLR disabled or bypassable. No public exploit code or active exploitation has been identified at time of analysis.
Nginx UI versions prior to 2.4.1 let an authenticated, OTP-enabled user holding only an ordinary JWT - without the X-Secure-Session-ID step-up header - create or modify Nginx configuration and trigger reload behavior by calling the nginx_config_add and nginx_config_modify tools through the /mcp and /mcp_message endpoints, which were protected by ordinary authentication alone. The equivalent HTTP configuration mutation routes correctly enforced the RequireSecureSession middleware, so the MCP channel constituted an alternate path around that control (CWE-288). Per the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, impact is limited to integrity and availability with high severity driven by unconstrained config writes; exploitation requires an existing low-privilege authenticated session on a pre-2.4.1 instance, and no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in version 2.4.1, and the upstream commit additionally hardened backup-related routes with RequireSecureSession.
Authenticated users with access to the MCP configuration interface in Nginx UI versions prior to 2.4.1 can bypass the directive filtering that the regular HTTP configuration API enforces, injecting restricted Nginx directives such as load_module, js_import, and js_content and then applying them via a configuration reload. Because the attacker can load the NJS module (ngx_http_js_module.so) and import JavaScript they control, they can execute arbitrary code inside the Nginx worker process, giving high impact to confidentiality, integrity, and availability of the managed Nginx instance. Exploitation requires a valid account (per the CVSS vector, PR:L, i.e. authenticated) and depends on the MCP interface being reachable and the Nginx build supporting NJS; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but it should be treated as high priority for any deployment below 2.4.1. The vendor-released patch is version 2.4.1, published with security advisory GHSA-5r62-gj48-897x.
Authenticated users of Nginx UI (0xJacky/Nginx-UI) prior to 2.4.1 can bypass the built-in nginx directive validation and write arbitrary nginx configuration through the MCP tool nginx_config_add, which reloads nginx with the injected directives. Where nginx is built with the njs or perl module (as in the official Docker image), an attacker - or an MCP-enabled AI agent steered by prompt injection - can achieve code execution on the nginx host with the privileges of the nginx worker process. The CVSS score of 8.8 reflects a network-reachable, low-complexity path requiring only authenticated MCP access (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), making this a credible, actionable priority rather than a paper-high CVSS; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Configuration validation bypass in Nginx UI (nginx-ui) prior to 2.4.1 lets an authenticated user with configuration-write privileges inject restricted Nginx directives by placing a benign directive first on a single line and appending a semicolon-separated restricted directive such as load_module, js_import, perl, or user root, because ValidateConfigDirectives only inspects the first token of each newline-split line. The flaw affects the REST, nginx_config_modify, site, and stream write paths and can escalate to arbitrary code execution in the Nginx worker context when a loadable Nginx module is already present on the host, a precondition that limits practical impact. No public exploit code was identified at the time of analysis, and the vendor released patch version 2.4.1.
Nginx UI installations before 2.4.1 expose two account-security endpoints, POST /api/otp_enroll and POST /api/finish_passkey_register, that let an attacker holding a stolen, valid JWT bind an attacker-controlled TOTP secret or register an attacker-controlled passkey against the victim's account, producing persistent access that survives a password change. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires an authenticated session rather than being unauthenticated, and no public exploit code has been identified at time of analysis. The TOTP path only succeeds if the victim has not already enabled TOTP, because it relies on an existing-enrollment guard, whereas the passkey registration path has no equivalent guard and is exploitable regardless of prior enrollment.
Nginx UI deployments that use Casdoor OAuth/SSO for authentication can issue a valid application session for an attacker-chosen identity on versions prior to 2.4.1, because the OAuth 'state' value is a fixed constant (the configured Casdoor application name) and the callback never binds it to the browser session that started the login. An unauthenticated attacker who persuades a victim to open a crafted Casdoor authorization link can have the victim's browser complete the attacker-controlled authorization flow, after which the callback mints an Nginx UI session for the identity returned by that authorization code - yielding high confidentiality impact with limited integrity impact (CVSS 3.1 7.1, AV:N/AC:L/PR:N/UI:R). The flaw is conditionally gated: it only applies to instances with Casdoor OAuth configured and requires victim interaction, so it is a genuine authentication-bypass issue rather than a universally exploitable one; no public exploit code was identified at time of analysis, and a vendor-released patch in version 2.4.1 is available.
Privilege escalation in Nginx UI lets any holder of an authenticated account take over the built-in administrator by changing the admin's password through POST /api/users/:id, which omits the RequireSecureSession step-up that the self-service password-change path enforces. Successful abuse silently invalidates the legitimate administrator's existing tokens, and the attacker can then authenticate as the administrator with full control over the Nginx configuration managed by the UI. All releases prior to 2.4.1 are affected; the vendor-released fix is version 2.4.1, and no public exploit code has been identified at time of analysis, though the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity, and availability. The practical exposure is gated by the need for a pre-existing low-privilege account, so multi-user deployments are directly at risk while single-admin instances that never provision secondary users have no untrusted principal to abuse.
Configuration-validation bypass in Nginx UI (versions 2.0.0-rc.6 through 2.4.0) lets an authenticated low-privilege user write arbitrary nginx configuration directives through the MCP tool nginx_config_add, which persists the file and triggers an nginx reload without ever calling config.ValidateConfigFile - the guard the REST endpoint POST /api/configs does invoke. Because blocked directives such as perl, js_import, load_module and user root can therefore be injected, an attacker on a host with the nginx Perl, njs or Lua module loaded can escalate this into post-authentication remote code execution; on hosts without a scripting module the effect is arbitrary config tampering and reload. The issue is fixed in Nginx UI 2.4.1, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Nginx UI versions prior to 2.4.1 fail to enforce the RequireSecureSession step-up check on multiple authenticated mutation endpoints, so an attacker who already holds a valid session token for an OTP- or passkey-enabled account can create or modify automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without ever supplying a fresh X-Secure-Session-ID. The flaw is a missing-authorization-check class issue (CWE-862) rated CVSS 3.1 base 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H): it requires a stolen or otherwise obtained authenticated session (PR:L) but no user interaction, giving high integrity and availability impact. No public exploit code was identified at time of analysis and there is no indication the issue is being actively exploited; the upstream fix is available in release 2.4.1.
Information disclosure in Grav CMS before 2.1.7 lets unauthenticated remote attackers retrieve Git metadata from nested repositories - for example /user/.git/ - exposing git config, refs, and object files that can be used to reconstruct unpublished history or recover committed secrets. The flaw exists because the web-server configurations bundled with Grav for nginx, lighttpd, IIS, and Caddy 2 block dot-prefixed paths such as .git only at the document root, so repositories created below the root (a version-controlled user/ directory, or git-installed plugins and themes) remain web-readable. No authentication or user interaction is required; no public exploit code or confirmed active exploitation was identified at time of analysis, and real-world impact is gated by the deployment precondition that a web-reachable nested Git repository actually exists and contains private history or sensitive commits. The vendor advisory (GHSA-5vx9-x8f2-f55w) points to the 2.1.7 release as the fix.
Missing second-factor step-up enforcement in the Nginx UI cluster API (versions 2.0.0 through 2.4.x) allows anyone holding a valid session token to perform node CRUD operations, read or replace stored node credentials, change namespaces, and trigger cluster-wide Nginx reload or restart actions without re-verifying a one-time password. The api/cluster router is protected by AuthRequired but omits RequireSecureSession, so a stolen or persisted JWT belonging to an OTP-enabled user is sufficient; the flaw is an incomplete fix for CVE-2026-84315 and was corrected in version 2.5.0. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and exposure is limited to clustered/multi-node deployments reachable on the network, so this is a high-priority issue for that specific population rather than a mass-internet emergency.
Attackers who control the Nginx UI upgrade mirror - or hold a man-in-the-middle position on the path to it - can get arbitrary code installed and executed by Nginx UI 2.0.0 through 2.4.x, because the self-upgrade routine verifies the downloaded binary only against a same-origin digest fetched from that same mirror, leaving no independent trust anchor. Exploitation requires two simultaneous conditions: the attacker's mirror/network position must let them alter BOTH the binary and its digest response, and an operator must manually trigger the self-upgrade, at which point the swapped payload is installed and runs in the Nginx UI process context. The issue is rated CVSS 7.5 (AV:N/AC:H/PR:N/UI:R) and is fixed in 2.5.0, which introduces minisign signature verification; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the high network-position prerequisite plus the required operator action substantially narrow realistic exploitation.
Ordinary authenticated users of clustered Nginx UI deployments can read the cluster node token from the JSON responses of /api/nodes and /api/nodes/:id and replay it in the X-Node-Secret header to be authenticated as a trusted peer node, crossing the node-to-node authentication boundary. Because the leaked secret is accepted by AuthRequired and mapped to the synthetic initUser principal, the attacker can reach sensitive management operations on any network-reachable cluster member, including configuration synchronization and service restarts. Affected versions are 2.0.0 through 2.4.x; the issue is fixed in Nginx UI 2.5.0. No public exploit code or confirmed active exploitation was identified at time of analysis, although the upstream fix commit is publicly visible.
Authenticated users of Nginx UI 2.0.0 through 2.4.x who hold permission to create and restore backups can persistently inject modified Nginx configuration or Nginx UI configuration files by crafting a backup archive that carries a symlink pointing at the live configuration path, achieving this even when the restore_nginx and restore_nginx_ui flags are both false. The flaw (CWE-59, link following) stems from the restore path extracting inner archives and materializing symlinks before the restore flags are enforced, so a regular file subsequently written through the staged link lands in the live configuration tree; the resulting tampering takes effect only when those files are later consumed by Nginx, and can produce denial of service. Rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), this requires a valid backup-capable login (PR:L) and is not a remote-unauthenticated attack, and no public exploit code was identified at time of analysis; vendor-released patch: 2.5.0 fully remediates the issue.
Cross-site request forgery in Nginx UI versions 2.0.0 through 2.4.x lets a remote attacker drive a logged-in administrator's browser into performing authenticated, state-changing management operations - including rewriting Nginx configuration through POST /api/configs, triggering config reloads, and invoking other admin endpoints - because the AuthRequired middleware accepts the browser-managed JWT cookie as a valid API credential while management routes generally enforce neither a CSRF token nor Origin/Referer validation. Exploitation requires the victim to be a currently logged-in administrator who is induced to visit an attacker-controlled page (UI:R); per the CVSS vector the attacker needs no credentials of their own (PR:N), but a targeted account protected by OTP/Passkey step-up, or an endpoint requiring secure-session proof, is not exploitable. The attacker cannot read cross-origin responses, so impact is blind configuration tampering and service disruption rather than data exfiltration; the issue is fixed in 2.5.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Account takeover in Nginx UI versions 2.0.0 through 2.4.x affects accounts configured with a passkey as their only second factor: the POST /api/login handler checks EnabledOTP but never requires a WebAuthn assertion when EnabledPasskey is true and no TOTP secret exists, so a valid password alone yields a fully authenticated session despite the account reporting a second factor. An attacker who already holds the account password can reach administrative Nginx UI functionality without possessing the registered passkey; accounts protected by TOTP, and accounts with no 2FA configured, are unaffected. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the AC:H metric reflecting the hard password precondition rather than any exploit complexity.
Credential exposure in Nginx UI 2.0.0 through 2.4.x allows anyone who recovers the Node.Secret master credential to bypass password, JWT, session, and second-factor checks and obtain persistent administrative API access to configuration and secret material. Versions in that range accept the Node.Secret through the node_secret query parameter on HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header, so the credential can leak into access logs, reverse-proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. Exploitation is conditional rather than trivial: node/cluster authentication must actually be in use, the secret must have been transmitted as a query parameter in practice, and the attacker must have read access to one of those sinks; no public exploit code has been identified at time of analysis, and the vendor rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) while our independent assessment scores it AV:N/AC:H/PR:N/UI:N with the same High confidentiality, integrity, and availability impact.
Authenticated administrators of Nginx UI releases 2.3.8 through 2.4.x can achieve remote code execution on the host by abusing the backup restore endpoint to overwrite live configuration with attacker-controlled nginx command settings. The attacker submits attacker-controlled portable backup key material along with a matching manifest to POST /api/restore; because the restore flow trusts the supplied key and treats the backup as 'portable', it decrypts the attacker's payload and replaces the live app.ini, including the protected TestConfigCmd value, after which a call to POST /api/nginx/test executes the restored command inside the Nginx UI runtime. The issue is rated CVSS 9.4 (CVSS 4.0) and CVSS 3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, is fixed in version 2.5.0, and at time of analysis there is no public exploit identified and no confirmed active exploitation (not listed in CISA KEV); the practical barrier is the high-privilege authenticated session required, so exposure is limited to instances where an admin account or session can be obtained by an untrusted party.
Unauthenticated remote clients that can reach the Nginx UI node-signature authentication API on versions 2.5.0 through pre-2.6.0 can force the server to stage attacker-controlled request bodies to temporary files and flush them to disk before any digest or cryptographic signature validation occurs, allowing exhaustion of temporary filesystem capacity, disk I/O, and request-processing resources. The impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) - authentication is not bypassed and there is no confidentiality or integrity impact. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch: 2.6.0, which caps staged node request bodies at 128 MiB and adds a pre-read ContentLength check.
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.
Denial of service in the npm package @angular/router when Server-Side Rendering (SSR) is enabled on Node.js allows an unauthenticated remote attacker to crash the SSR worker by exhausting the V8 old-space heap. Numeric matrix-parameter or outlet names (e.g. /a;990;2522) are stored as array-indexed properties on plain parameter objects, causing V8 to allocate dense HOLEY_ELEMENTS backing stores sized to the largest index, producing roughly 350x memory amplification (~20-25 KB of heap per 11-byte path segment) and a fatal 'JavaScript heap out of memory' error. Exploitation requires the app to run Angular SSR on Node.js, to parse user-controlled URLs directly through @angular/router, and an edge/reverse proxy that forwards semicolons and deep paths; roughly 12-22 concurrent 8 KB-path requests or 50-100 concurrent 1-2 KB-path requests are enough to kill a 256-512 MiB worker. Client-side Angular SPAs without SSR are not affected, and no public exploit code has been identified at time of analysis; the only impact is availability (no confidentiality or integrity impact).
Authentication bypass in the YunoHost sogo_yhn package lets any remote client impersonate an arbitrary SOGo user - including a privileged administrator - by simply sending an HTTP header, with no password required. The package configures SOGo to treat the 'x-webobjects-remote-user' header as a verified identity, and the bundled Nginx reverse proxy does not strip that inbound header, so it reaches the backend untouched; both the vendor CVSS 4.0 score (9.3) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirm unauthenticated, network-reachable, high-impact compromise without user interaction. The flaw is fixed in version 5.8.0~ynh9; no CISA KEV listing is associated with this CVE and no public exploit code was identified at time of analysis, but the trivial attack primitive (single header) and the exposed default configuration make prompt patching or proxy-level header stripping essential.
Broken access control in Nginx Proxy Manager through 2.16.0 lets a non-administrative user who has been granted 'manage' permissions over one or more hosts write arbitrary nginx directives into the advanced_config field, which the backend renders verbatim into the generated proxy host configuration. Because directives such as alias can be injected, an attacker can serve files from arbitrary paths or manipulate routing for the hosts they are assigned, changing the content (C:H) and, to a lesser degree, the integrity of what the proxy returns (I:L), though this is confined to that user's assigned hosts and no victim interaction is required. Exploitation requires an authenticated account with delegated manage rights (PR:L, AV:N), so single-admin deployments are not exposed to a lower-privileged attacker; there is no public exploit code identified and no confirmed active exploitation at time of analysis, and the issue is rated 7.1 on the CVSS 4.0 vector supplied alongside the advisory. An upstream fix exists (PR #5908) that gates advanced_config changes behind an isAdmin check, but no tagged patched release has been independently confirmed.
Missing rate limiting on the authentication API of Nginx Proxy Manager through 2.16.0 allows unauthenticated remote attackers to submit unlimited password guesses to POST /api/tokens and then unlimited TOTP guesses to POST /api/tokens/2fa, ultimately obtaining a valid session and full administrative control of the instance. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV, but the weakness is directly reachable by anyone who can talk to the admin interface, which is commonly internet-exposed on self-hosted deployments. Successful compromise is probabilistic rather than certain: it depends on the target account using a weak or previously-breached password and, where 2FA is enabled, on additionally guessing a rotating six-digit code, which is why our assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is more conservative than the published 9.1 CVSS 4.0 score.
wolfSSL builds that enable the WOLFSSL_TRUST_PEER_CERT macro can be induced to accept a forged clone of a trusted-peer CA, letting a malicious (D)TLS server bypass peer authentication; when OPENSSL_COMPATIBLE_DEFAULTS is also defined the flaw spreads to all CA certificate loading. The vulnerable path is reached through wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(), APIs used by autoconf/distro builds of nginx, haproxy, stunnel, wpa_supplicant, apache httpd, hitch, bind, rsyslog and ffmpeg, and exploitation is unauthenticated over the network (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The practical barrier is that the attacker must already know which certificates the victim loaded before a matching clone can be forged (assessment- and vendor-cited AT:P), so this is a targeted authentication bypass rather than a mass-exploitable one; patches exist upstream but no public exploit code has been identified at time of analysis.
Authenticated low-privilege Froxlor users with subdomain-create rights can inject arbitrary nginx or Apache configuration directives via CRLF sequences in the userinfo component of a subdomain redirect URL, leading to server-wide response hijacking and local file disclosure. The vulnerability affects versions 0 through 2.3.10 (incompletely fixed) and up to version 2.3.12, which contains the complete fix. The independent assessment rates this as a genuine high-priority vulnerability; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Grav CMS before 2.0.25 lets unauthenticated remote attackers read sensitive files - configuration secrets and account password hashes - when the site is served by Microsoft IIS using the bundled webserver-configs/web.config over a case-insensitive filesystem such as NTFS, simply by varying the case of a folder name or extension (for example GET /user/CONFIG/system.YAML) so that none of the case-sensitive URL Rewrite deny rules match. The practical blast radius is narrower than the raw path-bypass suggests: whether a bypassed file is actually returned depends on MIME registration, with .json served by default while .yaml/.yml return HTTP 404.3 on a stock IIS unless a YAML MIME mapping has been added; the equivalent gap in webserver-configs/lighttpd.conf is lower risk because lighttpd typically runs on case-sensitive filesystems, and deployments behind Apache (.htaccess), nginx, Caddy, or the PHP built-in server are not affected. No public exploit identified at time of analysis, and while the vendor-released patch is Grav 2.0.25, upgrading alone is insufficient because the .htaccess installer heal does not rewrite web.config or lighttpd.conf, so operators must manually re-copy the corrected sample files.
Frigate NVR deployments prior to 0.18.0 ship an nginx configuration that routes the prefix-matched location /api/go2rtc/api to the internal go2rtc API behind authentication but without an administrator role check, so any authenticated user holding only a low-privilege 'viewer' account can issue GET requests to that path and read proxied go2rtc data. Reachable subpaths (streams, config, log, stack) disclose internal network addresses, configuration file paths, application logs, goroutine stack traces, and RTSP stream URLs that may embed camera credentials; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) reflects remote, authenticated, read-only disclosure with changed scope, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. This is a genuine but bounded confidentiality issue: non-GET methods are rejected by limit_except GET, so no modification or lateral write is possible, the impact is contingent on RTSP URLs actually containing embedded camera credentials, and instances already upgraded to 0.18.0 are not affected. Authentication requirements are confirmed as authenticated by the CVSS vector (PR:L); unauthenticated attackers and administrators are outside the stated prerequisite set.
Authenticated viewer accounts in Frigate NVR can abuse the WebSocket message handler to invoke admin-only control topics, causing service restarts and disabling security monitoring functions across cameras. The flaw affects all releases prior to 0.17.2 and stems from the nginx authentication subrequest proving identity without conveying role information, so frigate/comms/ws.py forwards client-supplied topics to the dispatcher without any role check (CWE-862, missing authorization). Exploitation requires authentication to be enabled plus valid viewer-level credentials, meaning the realistic threat is an insider or the holder of a leaked or shared low-privilege account rather than an anonymous internet attacker; no public exploit code has been identified at time of analysis, and the vendor-released patch is version 0.17.2.
Authentication bypass in Mailu 2.0 through 2024.06.55 and Mailu helm-charts before 2.7.3 allows unauthenticated remote attackers to spoof the trusted proxy identity via a client-controlled X-Forwarded-By header, bypassing header-based proxy authentication. This affects only deployments with PROXY_AUTH_WHITELIST configured and REAL_IP_HEADER unset; default configurations are not vulnerable. The vendor has released fixes in Mailu 2024.06.55 and helm-charts 2.7.3, and no public exploit has been identified at time of analysis.
Unauthenticated administrator account creation in nginx-ignition affects deployments running versions prior to 2.41.1 that are still in their pre-onboarding state. The endpoint POST /api/users/onboarding/finish is registered as anonymous and, because its "onboarding already completed?" check is not atomic with the subsequent user write, a remote unauthenticated attacker (CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N, base 8.1) who can reach such an instance can create a full ReadWrite administrator account for themselves, and concurrent requests can create multiple admin accounts in a single race. No public exploit identified at time of analysis, and the practical window is narrow: exploitation requires the instance to be network-reachable while deployed but before a legitimate operator has completed onboarding - once onboarding is legitimately finished, the path is guarded.
Unauthenticated denial of service in nginx-ignition 2.29.0 through 2.40.0 lets any remote client that can reach the management API burn roughly 2.4 seconds of server CPU per request by sending a GET whose Accept-Language header is built from underscore-separated malformed language tags, since the gin i18n middleware parses the raw header unconditionally with no size or shape limit. Impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): ten concurrent attackers saturate a ten-core host for the duration of the attack while consuming about 10 MiB/s of upstream bandwidth, with no path to data access or code execution. No public exploit code identified at time of analysis and no CISA KEV entry; the vendor-released patch 2.40.1 fixes the issue.
Cache poisoning in the Open VSX registry allows an unauthenticated remote client to inject attacker-chosen download, signature, and public-key URLs into per-extension metadata that is then served to every other client, so downstream VS Code-compatible editors fetch and install an attacker-supplied VSIX. Exploitation requires the deployment to be reachable directly by clients, or fronted by a reverse proxy that relays rather than overwrites the client's X-Forwarded-Host/X-Forwarded-Proto/X-Forwarded-Prefix headers, with ovsx.server.url left unset and the attacker's source address treated as a trusted proxy (by default only loopback and private ranges are). Because the VSIX download URL, its signature URL and the verifying public key URL are all derived from the same base URL, extension signing provides no protection; poisoned entries persist for the cache lifetime (one hour by default) and spread cluster-wide when ovsx.redis.enabled is set. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the prerequisite is a common default deployment shape, so the risk is real and high rather than theoretical.
Unauthenticated arbitrary file upload in the Paid Downloads WordPress plugin (all versions up to and including 3.15) lets remote attackers bypass authorization and file-type checks in the admin_request_handler function to place attacker-controlled files on the server, which can lead to remote code execution. The flaw is reachable without credentials because is_admin() returns true for requests to /wp-admin/admin-post.php, and the handler performs neither a capability check nor an extension/content validation; per assessment, the AC:H rating reflects that reliable code execution depends on server configuration - Apache deployments with AllowOverride enabled may have retrieval of the uploaded file blocked by a plugin-placed .htaccess, confining dependable RCE to nginx, LiteSpeed, or Apache with AllowOverride None, while the upload and authorization bypass itself succeeds on any stack. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated upload primitive combined with a CVSS 8.1 score makes this a high-priority, patch-dependent risk for any site running the plugin.
Configuration injection in the Froxlor hosting control panel (all versions before 2.2.5) lets an authenticated customer embed literal newline characters in a subdomain redirect URL, which are written verbatim into nginx or Apache vhost configuration files when the privileged cron job rebuilds them. Because the injected lines become active web server directives affecting other hosted domains on the same server, a low-privileged tenant can corrupt configs, cause denial of service, or hijack HTTP responses across co-hosted sites. This is a CWE-93 CRLF/newline-injection flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
TLS certificate verification is disabled by default in Socket Firewall (socketdev/socket-registry-firewall) before version 2.0.0, enabling network-positioned attackers to conduct man-in-the-middle attacks against the firewall's outbound connections to both the Socket API and upstream package registries. When the api_ssl_verify and upstream_ssl_verify keys are omitted from socket.yml, the generated configuration explicitly sets both to false, causing the OpenResty/Lua HTTP client to accept any certificate - including self-signed and untrusted certificates - without chain validation. A successful attacker can substitute malicious package content or alter the allow/block policy decisions the firewall enforces, effectively weaponizing the supply chain security control against the organizations it protects. No public exploit has been identified at time of analysis.
Authentication bypass in Traefik v3.7.0 through v3.7.11 lets remote unauthenticated attackers reach protected Kubernetes backends when an Ingress uses the ingress-nginx compatibility provider with both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The provider generates a host-only 'sibling' router carrying only a non-terminal RedirectRegex middleware that still routes to the protected backend, so a crafted request evades the redirect and is proxied without any annotation-derived middleware. Reported by VulnCheck with a published advisory; no public exploit is identified at time of analysis, though the technique is fully documented and trivially reproducible.
Password-protected live stream bypass in AVideo exposes RTMP stream keys, HLS playlist URLs, and AES-128 decryption keys to unauthenticated remote callers via two compounding failures. The PHP-side stats API (`Live::_getStats()` in `plugin/Live/Live.php`) returns protected transmission credentials regardless of password check outcome - including the hidden_applications branch invoked when `canSeeLiveFromLiveKey()` denies access. Independently, the shipped NGINX configuration leaves the `/live` location serving `.m3u8` playlists, AES-128 segment encryption keys, and `.ts` segments without any `auth_request` directive (the `auth_key_check` in the `.key` block is commented out), allowing full stream decryption without the configured password. No patched version was available at time of the advisory.
Unauthenticated LAN access to the ESPHome Device Builder dashboard on Home Assistant add-on deployments allows any device on the local network to gain host-equivalent control with no credentials. The ingress site, which deliberately skips authentication because the HA supervisor is supposed to authenticate upstream, was bound to 0.0.0.0 instead of loopback and the supervisor gateway. Because the add-on uses host networking for mDNS, this exposed the no-auth site on the host's LAN interface, directly bypassing the supervisor's authentication layer. An attacker with LAN access can run arbitrary Python via external_components at compile time, execute arbitrary shell through compile/validation subprocesses, and read or write arbitrary files in the config and data directories. No public exploit has been identified at time of analysis.
Authenticated administrative users of Okta Access Gateway can achieve arbitrary command execution on the underlying gateway host by storing crafted values in an application's label field, which the product interpolates without sanitization into generated nginx server block configuration. The flaw affects Okta Access Gateway versions prior to 2026.9.1 (CPE cpe:2.3:a:okta:access_gateway), scores CVSS 3.1 base 7.2 (High) with total confidentiality, integrity, and availability impact under vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and requires high-privilege (PR:H) access to the management console to seed the malicious label - no user interaction is needed, and the injected directives take effect when the gateway regenerates and reloads its nginx configuration. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and EPSS is low at 0.36% (29th percentile), so this is best characterized as an admin-to-host privilege-abuse vector rather than a remotely exploitable unauthenticated issue.
Client certificate authentication bypass in Traefik v3.7.0-v3.7.10 allows unauthenticated network clients to reach services protected by the nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" annotation without presenting a valid mTLS client certificate. The flaw stems from a naming collision in the Kubernetes Ingress NGINX provider: when two Ingress objects share the same host, client CA secret, and authentication mode, Traefik's conflict-resolution logic silently falls back to the entry point's default TLS configuration, which imposes no client certificate requirement. No public exploit has been identified at time of analysis, and the issue is fixed in Traefik v3.7.11.
NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching.
Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.
Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to Ingress resources to embed arbitrary NGINX configuration directives through unsanitized annotation fields. The configuration generator passes multiple user-controllable annotation values directly into the generated nginx.conf without sanitization, enabling an attacker to inject directives that create or delete files, disable services, or manipulate NGINX routing behavior. Impact is confined to the Kubernetes control plane; the NGINX data plane itself is not directly reachable through this vulnerability.
Configuration injection in NGINX Gateway Fabric allows authenticated Kubernetes users with CRD or Secret write permissions to embed arbitrary NGINX directives into the generated server configuration. The vulnerability originates in the NGINX configuration generator component, which renders Authentication Filter fields - clientID, cookieName, and clientSecret - directly into configuration templates without sanitization. Successful exploitation is limited to the control plane; no data-plane traffic is directly manipulated, but an attacker can introduce directives that compromise confidentiality and integrity of the NGINX Plus configuration. No public exploit has been identified and the issue is not listed in CISA KEV at time of analysis.
NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern.
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PHP or HTML files with attacker-controlled names to the plugin's temporary upload directory by exploiting chunk-state hash reuse in the `GFAsyncUpload::upload()` function. On NGINX or other non-`.htaccess`-respecting web servers, this leads to remote code execution; on Apache deployments the plugin's bundled `.htaccess` file blocks PHP execution, though attacker-written `.html` files can still produce stored same-origin XSS if a victim visits the generated URL. No public exploit has been identified at time of analysis, and exploitation is meaningfully constrained by two simultaneous prerequisites: a specific form configuration and a non-Apache web server.
Path traversal in Kirby CMS's media handler exposes arbitrary .json file existence and potentially image file contents to remote unauthenticated attackers on affected server configurations. The vulnerability exists in two code paths - Media::thumb() in src/Cms/Media.php and the file::version path in src/Filesystem/Asset.php - both of which failed to reject URL-encoded slash characters or literal ../ sequences before resolving paths relative to validated media directories. Fixed in versions 4.9.5 and 5.5.2; no public exploit code has been identified at time of analysis, and CISA KEV listing is absent.
Remote unauthenticated denial-of-service in alos-http, a Linux amd64 Go web framework, allows any network-reachable client to crash the entire server process with a single malformed HTTP request. The flaw exists in the request-line parser's `sanitizeRequestPath` function, which performs an unchecked index into an empty string after stripping a bare query-string path such as `GET ? HTTP/1.1`. Because the panic fires in the connection-worker goroutine before the handler chain, the framework's own `core.Recovery()` middleware cannot intercept it, making the crash total and immediate. A publicly available proof-of-concept exploit exists; the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated remote destruction of pending-deletion accounts is possible in APITable through 1.13.0-beta.1, where two internal user-management endpoints are reachable by any network client without credentials. The InternalUserController annotates both getUserHistories and closePausedUserAccount with requiredLogin = false, causing ResourceInterceptor to skip all session and API-key validation; the bundled nginx gateway forwards every /api request to the backend, giving external attackers a direct path. An attacker can enumerate accounts in the 30-day deletion cooling-off window and then permanently destroy each one - wiping PII, cancelling subscriptions, removing space memberships, and revoking OAuth bindings - with no possibility of recovery. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in Laravel Backpack CRUD's Stats::makeCurlRequest method allows unauthenticated remote attackers to execute arbitrary OS commands as the web server user by supplying a crafted HTTP Host header. All four maintained branches are affected: 4.1.x before 4.1.72, 5.x before 5.6.2, 6.x before 6.8.13, and 7.x before 7.0.36. No public exploit code or CISA KEV listing exists at time of analysis, but the only in-code guard is a 1-in-100 probabilistic gate that provides no meaningful protection against a determined attacker who can retry requests.
Remote stack-based buffer overflow in the embedded nginx binary (/usr/nginx/sbin/nginx) of the TRENDnet TEW-WLC100 wireless LAN controller, firmware 1v2.07b01, lets remote attackers overflow a fixed-size stack buffer in the HTTP Server-header handling routine FUN_0040da4c. Reported through VulDB with a public proof-of-concept exploit already available, the flaw carries a CVSS 4.0 base score of 9.3 and, per its vector, requires no authentication or user interaction. There is no public exploit identified as being used in active attacks - only a POC exists - but the combination of a network-reachable overflow and released exploit code makes this a high-priority patching candidate.
Customer-uploaded file disclosure in Extra Product Options Builder for WooCommerce (all versions before 1.2.176) allows unauthenticated requesters who know a file's stored name to retrieve it via an unprotected plugin endpoint, bypassing a missing authorization check (CWE-862). The real-world severity is conditional on web server type: the plugin writes deny-all rules to upload directories, meaning this endpoint only crosses a new security boundary on Apache-hosted sites; on default nginx deployments, those files are already directly URL-accessible and the endpoint adds no measurable additional exposure. Publicly available exploit code exists, but no public exploit identified at time of analysis confirms active exploitation, and EPSS sits at 0.22% (12th percentile) despite the elevated CVSS score.
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., `/x/../upload/...`) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. No public exploit has been identified at time of analysis, and CISA has released a fix in v26.07.0.
Authenticated users holding only the granular ROLE_UPLOAD permission in CISA's Malcolm network traffic analysis suite can upload a .php file that the suite's own nginx routes to php-fpm and executes as www-data inside the file-upload container, yielding remote code execution in the file-upload component. The flaw (CWE-434, unrestricted file upload) affects Malcolm versions before 26.06.1 and is reachable only when Malcolm runs in RBAC mode, where the upload endpoint is exposed to the upload-only role; unauthenticated users cannot reach it (CVSS:3.1 PR:L, assessed high impact C:H/I:H/A:H). There is no public exploit code identified at time of analysis and EPSS is low (0.30%, 22nd percentile), while the vendor-released fix is Malcolm 26.06.1.
Cross-user HTTP response poisoning in Traefik's default reverse proxy allows an unauthenticated remote attacker using HTTP/2 or HTTP/3 to smuggle responses into other clients' backend connections, potentially delivering authenticated or private content from one user to another. All supported Traefik branches through v2.11.52, v3.6.23, and v3.7.8 are affected in default configuration when fronting Go net/http or gunicorn/Flask backends, which are confirmed 'armed' (respond to CONNECT with keep-alive non-2xx without draining the body). A proof-of-concept is publicly available demonstrating reliable cross-user poisoning including a cascade scenario where 8 of 8 sequential victims read responses that were not their own; no CISA KEV listing was present at time of analysis.
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endpoints protected by BasicAuth, DigestAuth, or ForwardAuth by exploiting unnormalized dot-segment paths generated by the Kubernetes Ingress NGINX provider's RewriteTarget middleware. When an Ingress path regex captures attacker-controlled text without requiring a path separator (e.g., /api(.*) rewriting to /$1), a crafted request such as /api../admin is rewritten to /../admin and forwarded to a backend that resolves it to /admin - a path secured on a separate Traefik router - entirely bypassing route-level access controls. No public exploit has been identified at time of analysis; a vendor patch is available in v3.7.8.
Remote unauthenticated Denial of Service in Datadog's dd-trace-rb Ruby tracing library (versions before 2.32.0) allows attackers to exhaust CPU and memory by sending HTTP requests with oversized or high-cardinality W3C `baggage` headers. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) limits were enforced only on injection and not extraction, the tracer allocates a hash-map entry per comma-separated pair on every request. Baggage propagation is enabled by default, so any internet-facing instrumented Ruby service is exposed; no public exploit was identified at time of analysis, and this CVE is not listed in CISA KEV.
Remote denial of service in Datadog's dd-trace-go APM library lets unauthenticated attackers exhaust CPU and memory on any instrumented HTTP service by sending an oversized W3C 'baggage' header. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safety limits were enforced only on baggage injection, not extraction, so a single crafted request with a huge number of comma-separated key-value pairs forces one hash-map allocation per pair on every request. Because baggage propagation is enabled by default, any internet-facing Go service using an affected tracer is exposed; there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote unauthenticated Denial of Service in the Datadog.Trace .NET tracing library (versions before 3.43.0) arises because W3C baggage HTTP headers are parsed on the extract path without enforcing the DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits that are only applied during injection. An attacker can send a single request with a baggage header containing an arbitrarily large number of comma-separated key-value pairs, forcing the tracer to allocate a hash-map entry per pair and exhausting CPU and memory. Because the baggage propagation style is enabled by default, any internet-facing service instrumented with an affected tracer is exposed; there is no public exploit identified at time of analysis and the CVSS is 7.5 (A:H only).
Remote unauthenticated Denial of Service in the Datadog dd-trace-js Node.js tracing library (versions < 5.100.0) allows attackers to exhaust CPU and memory by sending an HTTP request with an oversized W3C 'baggage' header. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) caps were enforced only on injection and not on the extraction path, the tracer allocates a hash-map entry per comma-separated pair on every request. With baggage propagation enabled by default, any internet-facing instrumented service is exposed. CVSS 3.1 base score is 7.5 (A:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote denial of service in Datadog's dd-trace-py Python tracing library (versions before 4.8.2) lets unauthenticated attackers exhaust CPU and memory by sending oversized W3C 'baggage' HTTP headers. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safeguards were enforced only on baggage injection, never on extraction, so a single crafted request with a huge number of comma-separated pairs forces the tracer to allocate a hash-map entry per pair on every request. Because the baggage propagation style is enabled by default, any reachable service instrumented with an affected tracer is exposed; no public exploit identified at time of analysis.
Remote denial of service in Datadog's dd-trace-java (dd-java-agent) tracing library affects any HTTP service instrumented with a version below 1.62.0 that has W3C baggage propagation enabled, which is the default. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) caps were enforced only on baggage injection and not on extraction, a remote unauthenticated attacker can send a single crafted 'baggage' header with a huge number of key-value pairs or one oversized value to exhaust CPU and memory. There is no public exploit identified at time of analysis and it is not on CISA KEV, but exploitation is trivially reliable (CVSS 7.5, AV:N/AC:L/PR:N).
Limited memory disclosure and worker-process restart in NGINX Plus and NGINX Open Source arise when the optional ngx_http_slice_module is compiled in and configured alongside unnamed regex captures, or when a background cache update occurs, letting remote attackers trigger uninitialized memory access (CWE-908) in the data plane. The CVSS:4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with no user interaction, scored 8.8. There is no public exploit identified at time of analysis and no CISA KEV listing; F5 has released a patch and the issue does not affect the control plane.
Heap buffer over-read in the ngx_http_ssi_module of NGINX Open Source and NGINX Plus lets an unauthenticated man-in-the-middle attacker who can control upstream responses corrupt worker-process memory or crash the worker, but only in the non-default configuration combining Server-Side Includes, proxy_pass, and proxy_buffering off. The impact is confined to the data plane with no control-plane exposure, yielding limited memory modification and worker restarts (denial of service) rather than full code execution. No public exploit identified at time of analysis, though a vendor patch is available and the flaw carries a CVSS 4.0 score of 8.3.
Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (DoS) and, on hosts with ASLR disabled or bypassed, potentially execute arbitrary code by sending crafted HTTP requests. The flaw is a data-plane-only issue triggered when a regex-based map directive references the map's regex capture variables before the map output variable in a string expression, or via a non-cacheable variable under certain conditions. F5 has released a patched version; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in F5 NGINX Ingress Controller allows an authenticated remote attacker holding write access to Ingress or TransportServer resources to crash the control plane by submitting a malformed resource. Because the offending resource persists in the cluster, the controller re-reads it and re-crashes, producing a durable crash loop rather than a one-time outage. There is no public exploit identified at time of analysis, and impact is confined to the control plane with no data plane or confidentiality/integrity exposure.
Configuration injection in F5 NGINX Ingress Controller lets an authenticated Kubernetes user with rights to create or modify Ingress CRDs or annotations smuggle arbitrary NGINX directives into the generated configuration. Because multiple user-controllable fields are written to the config without sanitization, an attacker can inject directives that create or delete files and disable services on the control plane. No public exploit identified at time of analysis; this is a control-plane-only issue with no data plane exposure, but the CVSS 4.0 score of 8.7 (High) reflects strong confidentiality and integrity impact.
Remote code execution in the plank/laravel-mediable package before 7.0.0 lets attackers upload a double-extension file such as shell.php.jpg that passes all MIME, extension, and aggregate-type validation because of the trailing .jpg, yet retains an inner .php in its stored basename. On Apache/nginx servers misconfigured to execute any filename containing .php, the stored artifact runs as PHP. Reported by VulnCheck with a vendor patch in 7.0.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
WAF filtering bypass in OWASP ModSecurity (libmodsecurity) before 3.0.16 lets remote unauthenticated attackers smuggle malicious payloads past inspection rules by exploiting a multipart/form-data parser differential. The engine silently strips embedded line breaks from non-file form-field values before populating ARGS and ARGS_POST, so any rule whose detection depends on a newline (e.g. command, header, or injection syntax spanning a line break) fails to match while the backend still receives and acts on the intact payload. No public exploit identified at time of analysis, but the CVSS base score of 8.6 reflects a scope-changing integrity impact on every application shielded by an affected deployment.
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV.
Privilege escalation in Frigate 0.17.1 allows any authenticated user, including low-privilege viewers, to download logs
Single-use authorization-code enforcement can be bypassed under concurrency in the better-auth OAuth provider (@better-auth/oauth-provider 1.6.0 through 1.6.10, the embedded plugin in better-auth 1.4.8-beta.7 through 1.6.10, and the legacy oidc-provider and mcp plugins). Because the POST /oauth2/token authorization_code grant redeems the code via a non-atomic find-then-delete, two concurrent requests carrying the same code both pass the read step and each mint a fresh access, refresh, and id token for the original user's scope. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor rates it CVSS 4.0 7.6 (High) with high confidentiality and integrity impact.
Account takeover in FOSSBilling 0.5.6 through 0.7.2 arises because the reset_password guest API endpoint reuses an existing, unexpired ClientPasswordReset token rather than rotating it on each request. An attacker who has captured a victim's earlier reset link retains a valid path to hijack the account even after the victim requests a fresh reset, since the original token is never invalidated and its 15-minute window is anchored to the first request. No public exploit is identified at time of analysis, and the CVSS 4.0 score is 7.7 (High); version 0.8.0 fixes the flaw.
Arbitrary file read in GravitLauncher LaunchServer ≤ 5.7.11 lets an unauthenticated remote attacker retrieve any file readable by the server process via a path-traversal in the default-enabled HTTP file server on port 9274. Because the exposed files include the ECDSA key that signs access JWTs (.keys/ecdsa_id), the refresh-token salt, and database credentials, the flaw escalates from information disclosure to a full authentication bypass allowing forged admin tokens. Publicly available exploit code exists (a raw-socket PoC in the advisory); the issue is not listed in CISA KEV and no active exploitation is confirmed.
Arbitrary file disclosure and PHP local file inclusion in Cockpit CMS before release 364 lets unauthenticated remote attackers read files outside the web root and, on certain server setups, cause the application to include() attacker-chosen .php files. The flaw stems from unvalidated PATH_INFO (derived from REQUEST_URI) being used to build filesystem paths without containment checks. Publicly available exploit code exists; it is not listed in CISA KEV and no EPSS score was provided.
Arbitrary file upload leading to remote code execution in the Divi Form Builder WordPress plugin (versions through 5.1.8) lets unauthenticated attackers upload executable PHP files and run arbitrary code on the server. Attacker-controlled input from the acceptFileTypes POST parameter is interpolated directly into the file-validation regex in do_image_upload(), allowing alternate PHP extensions (.phtml, .phar, .php5, .php7) that evade the plugin's .php-only .htaccess block - and on Nginx the .htaccess protection does not apply at all. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 9.8 rating and Wordfence's technical disclosure make this a high-priority patching target.
Denial of service in Fluentd (rubygems package, versions <= 1.19.2) lets remote attackers crash the log collector by sending a gzip decompression bomb to the in_http (default port 9880) or in_forward (default port 24224) plugins. Although Fluentd enforces body_size_limit and chunk_size_limit on the compressed payload, it applies no ceiling on the decompressed output, so a tiny crafted payload expands in memory until the OS OOM-kills the process. No public exploit identified at time of analysis and it is not in CISA KEV, but EPSS-style risk is bounded by the requirement that an input port be reachable from an untrusted network.
Vulnity Security, a WordPress plugin maintained by Manuel Galan, can be bypassed to gain administrator access on Nginx-based installations running version 1.4.3 or earlier. The plugin's delegated-login feature writes a pairing credential file and auto-generates an Nginx configuration snippet intended to block web access to it, but the snippet guards the wrong directory path, leaving the credential file reachable by unauthenticated attackers who can then forge signed REST API requests and authenticate as an administrator. No public exploit code or confirmed active exploitation was identified at time of analysis, but the attack requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), with High complexity arising from the dependency on a qualifying Nginx deployment where the delegated-login pairing credential exists and the flawed snippet is active; Apache and other web servers appear unaffected.
Remote code execution via arbitrary file upload affects the YaySMTP WordPress plugin in all versions up to and including 2.7.7, where an authenticated subscriber-level user can upload executable files through the putFile function. The plugin relies on sanitize_file_name() without an allow-list, MIME check, or safe-extension rename, and its only server-side guard is a .htaccess file with 'Require all denied' that nginx and Apache with AllowOverride None ignore, so full RCE is achievable on those configurations. No public exploit code was identified at time of analysis and there is no confirmed CISA KEV active exploitation; exploitation requires authentication at subscriber level or above, which is commonly available when open user registration is enabled.
Authentication bypass in F5 NGINX Ingress Controller allows unauthenticated remote attackers to access protected paths when an externalAuth policy delegating to an OAuth identity provider is configured. The flaw is due to incorrect handling of the IdP's HTTP response (CWE-303), enabling access before proper authentication completes. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), it requires no privileges or user interaction, impacts confidentiality only, and is strictly a data plane issue with no control plane exposure. No public exploit has been identified at time of analysis; only deployments using externalAuth with OAuth are affected.
Canonicalization inconsistency in the NGINX JavaScript (njs) XML module lets an unauthenticated attacker who already holds a genuinely signed SAML/XML document cause entity-backed attributes to appear absent or truncated ($attr$Name returning undefined, $attrs derived from only the first attribute child) while signature verification still succeeds. nginx-saml running the built-in njs backend is the confirmed affected consumer, where this can bypass expiry, Destination, and request-correlation checks and enable replay or acceptance of a response outside its intended context; the flaw cannot forge signatures or identities and has no availability or control-plane impact. F5's advisory rates this 8.3 (High, CVSS 4.0 with AT:P reflecting the significant effort needed to obtain a validly signed document); no public exploit code was identified at time of analysis, and no KEV listing applies. There is no public exploit identified at time of analysis.
Unauthenticated, remote attackers can bypass authentication and reach protected paths in F5 NGINX Kubernetes Ingress Controller (NIC) deployments configured with the ExternalAuth policy or Ingress external authentication. The flaw (CWE-290, authentication bypass by spoofing) occurs because client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers are forwarded unsanitized into the internal NGINX auth_request subrequest, letting an attacker spoof the request attributes the external authentication provider evaluates; exploitation is remote, low-complexity and requires no authentication or user interaction, but is gated on the non-default external-auth configuration and is bounded to the data plane, affecting confidentiality/access only (no control plane exposure, no integrity or availability impact). No public exploit identified at time of analysis.
A namespaced authenticated attacker holding access to a Kubernetes service account can impersonate the NGINX Agent gRPC connection in NGINX Gateway Fabric and read TLS private keys belonging to Gateway deployments in other namespaces. Exploitation requires the Gateway Custom Resource Definition to be configured and an authenticated gRPC link between the control plane and NGINX Agent, making this an access-gated control-plane disclosure flaw with no data plane exposure. No public exploit code was identified at the time of analysis.
Directive injection in NGINX Gateway Fabric lets an authenticated namespaced tenant escape the auth_basic "<realm>"; quoting rendered into a shared data-plane nginx.conf and inject arbitrary NGINX directives. Exploitation requires a multi-tenant deployment in which several namespaces share one Gateway/data plane, plus namespaced RBAC to create an AuthenticationFilter CRD and attach it via spec.basic.realm or spec.jwt.realm to an HTTPRoute or GRPCRoute bound to that Gateway (CVSS vector shows PR:L and UI:N, so valid authenticated credentials are required and no user interaction is needed). The impact is control-plane only, with no data-plane exposure, but a successful attacker could read co-located tenants' mounted secrets, perform SSRF through proxy_pass, read the pod ServiceAccount token, or hijack other tenants' routes; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing 'include virtual' commands is processed, causing memory corruption or a worker process crash. This affects both NGINX Plus and NGINX Open Source, with code execution possible only on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration (AIO and SSI enabled), and no public exploit code was identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default map directive with regex matching is configured so that the root directive or access log format references the map's regex capture variables before the map output variable, or when a non-cacheable variable is used in a string expression under specific conditions. The flaw is remotely reachable without authentication (CVSS PR:N) but has high attack complexity (AC:H) because exploitation depends on conditions beyond the attacker's control and on a non-default configuration; the realistic outcome on systems with ASLR enabled is worker-process restart/DoS, while code execution is limited to systems with ASLR disabled or bypassed. F5 rates this CVSS 4.0 9.2 (Critical), and no public exploit identified at time of analysis.
SSL session ticket key handling in NGINX Plus and NGINX Open Source can let a remote unauthenticated attacker forge client SSL sessions and bypass client certificate verification, but only on instances that enforce mutual TLS and rely on NGINX's automatic ticket key rotation. Exploitation is conditional and non-deterministic: the affected deployments must be configured with ssl_session_cache shared:name:size and must not set an explicit ssl_session_ticket_key file, and the resulting forgery is beyond the attacker's control (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, 6.5). There is confirmed data-plane information exposure potential but no control-plane exposure, and no public exploit identified at time of analysis.
Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through crafted HTTP requests, but only when a non-default configuration uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, or when $request_filename is used in an access log format directive. Successful exploitation causes a heap buffer overflow in the NGINX worker process, leading to a restart (denial of service) and potentially allowing code execution on systems with ASLR disabled or bypassable. No public exploit code or active exploitation has been identified at time of analysis.
Nginx UI versions prior to 2.4.1 let an authenticated, OTP-enabled user holding only an ordinary JWT - without the X-Secure-Session-ID step-up header - create or modify Nginx configuration and trigger reload behavior by calling the nginx_config_add and nginx_config_modify tools through the /mcp and /mcp_message endpoints, which were protected by ordinary authentication alone. The equivalent HTTP configuration mutation routes correctly enforced the RequireSecureSession middleware, so the MCP channel constituted an alternate path around that control (CWE-288). Per the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, impact is limited to integrity and availability with high severity driven by unconstrained config writes; exploitation requires an existing low-privilege authenticated session on a pre-2.4.1 instance, and no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in version 2.4.1, and the upstream commit additionally hardened backup-related routes with RequireSecureSession.
Authenticated users with access to the MCP configuration interface in Nginx UI versions prior to 2.4.1 can bypass the directive filtering that the regular HTTP configuration API enforces, injecting restricted Nginx directives such as load_module, js_import, and js_content and then applying them via a configuration reload. Because the attacker can load the NJS module (ngx_http_js_module.so) and import JavaScript they control, they can execute arbitrary code inside the Nginx worker process, giving high impact to confidentiality, integrity, and availability of the managed Nginx instance. Exploitation requires a valid account (per the CVSS vector, PR:L, i.e. authenticated) and depends on the MCP interface being reachable and the Nginx build supporting NJS; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but it should be treated as high priority for any deployment below 2.4.1. The vendor-released patch is version 2.4.1, published with security advisory GHSA-5r62-gj48-897x.
Authenticated users of Nginx UI (0xJacky/Nginx-UI) prior to 2.4.1 can bypass the built-in nginx directive validation and write arbitrary nginx configuration through the MCP tool nginx_config_add, which reloads nginx with the injected directives. Where nginx is built with the njs or perl module (as in the official Docker image), an attacker - or an MCP-enabled AI agent steered by prompt injection - can achieve code execution on the nginx host with the privileges of the nginx worker process. The CVSS score of 8.8 reflects a network-reachable, low-complexity path requiring only authenticated MCP access (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), making this a credible, actionable priority rather than a paper-high CVSS; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Configuration validation bypass in Nginx UI (nginx-ui) prior to 2.4.1 lets an authenticated user with configuration-write privileges inject restricted Nginx directives by placing a benign directive first on a single line and appending a semicolon-separated restricted directive such as load_module, js_import, perl, or user root, because ValidateConfigDirectives only inspects the first token of each newline-split line. The flaw affects the REST, nginx_config_modify, site, and stream write paths and can escalate to arbitrary code execution in the Nginx worker context when a loadable Nginx module is already present on the host, a precondition that limits practical impact. No public exploit code was identified at the time of analysis, and the vendor released patch version 2.4.1.
Nginx UI installations before 2.4.1 expose two account-security endpoints, POST /api/otp_enroll and POST /api/finish_passkey_register, that let an attacker holding a stolen, valid JWT bind an attacker-controlled TOTP secret or register an attacker-controlled passkey against the victim's account, producing persistent access that survives a password change. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires an authenticated session rather than being unauthenticated, and no public exploit code has been identified at time of analysis. The TOTP path only succeeds if the victim has not already enabled TOTP, because it relies on an existing-enrollment guard, whereas the passkey registration path has no equivalent guard and is exploitable regardless of prior enrollment.
Nginx UI deployments that use Casdoor OAuth/SSO for authentication can issue a valid application session for an attacker-chosen identity on versions prior to 2.4.1, because the OAuth 'state' value is a fixed constant (the configured Casdoor application name) and the callback never binds it to the browser session that started the login. An unauthenticated attacker who persuades a victim to open a crafted Casdoor authorization link can have the victim's browser complete the attacker-controlled authorization flow, after which the callback mints an Nginx UI session for the identity returned by that authorization code - yielding high confidentiality impact with limited integrity impact (CVSS 3.1 7.1, AV:N/AC:L/PR:N/UI:R). The flaw is conditionally gated: it only applies to instances with Casdoor OAuth configured and requires victim interaction, so it is a genuine authentication-bypass issue rather than a universally exploitable one; no public exploit code was identified at time of analysis, and a vendor-released patch in version 2.4.1 is available.
Privilege escalation in Nginx UI lets any holder of an authenticated account take over the built-in administrator by changing the admin's password through POST /api/users/:id, which omits the RequireSecureSession step-up that the self-service password-change path enforces. Successful abuse silently invalidates the legitimate administrator's existing tokens, and the attacker can then authenticate as the administrator with full control over the Nginx configuration managed by the UI. All releases prior to 2.4.1 are affected; the vendor-released fix is version 2.4.1, and no public exploit code has been identified at time of analysis, though the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity, and availability. The practical exposure is gated by the need for a pre-existing low-privilege account, so multi-user deployments are directly at risk while single-admin instances that never provision secondary users have no untrusted principal to abuse.
Configuration-validation bypass in Nginx UI (versions 2.0.0-rc.6 through 2.4.0) lets an authenticated low-privilege user write arbitrary nginx configuration directives through the MCP tool nginx_config_add, which persists the file and triggers an nginx reload without ever calling config.ValidateConfigFile - the guard the REST endpoint POST /api/configs does invoke. Because blocked directives such as perl, js_import, load_module and user root can therefore be injected, an attacker on a host with the nginx Perl, njs or Lua module loaded can escalate this into post-authentication remote code execution; on hosts without a scripting module the effect is arbitrary config tampering and reload. The issue is fixed in Nginx UI 2.4.1, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Nginx UI versions prior to 2.4.1 fail to enforce the RequireSecureSession step-up check on multiple authenticated mutation endpoints, so an attacker who already holds a valid session token for an OTP- or passkey-enabled account can create or modify automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without ever supplying a fresh X-Secure-Session-ID. The flaw is a missing-authorization-check class issue (CWE-862) rated CVSS 3.1 base 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H): it requires a stolen or otherwise obtained authenticated session (PR:L) but no user interaction, giving high integrity and availability impact. No public exploit code was identified at time of analysis and there is no indication the issue is being actively exploited; the upstream fix is available in release 2.4.1.
Information disclosure in Grav CMS before 2.1.7 lets unauthenticated remote attackers retrieve Git metadata from nested repositories - for example /user/.git/ - exposing git config, refs, and object files that can be used to reconstruct unpublished history or recover committed secrets. The flaw exists because the web-server configurations bundled with Grav for nginx, lighttpd, IIS, and Caddy 2 block dot-prefixed paths such as .git only at the document root, so repositories created below the root (a version-controlled user/ directory, or git-installed plugins and themes) remain web-readable. No authentication or user interaction is required; no public exploit code or confirmed active exploitation was identified at time of analysis, and real-world impact is gated by the deployment precondition that a web-reachable nested Git repository actually exists and contains private history or sensitive commits. The vendor advisory (GHSA-5vx9-x8f2-f55w) points to the 2.1.7 release as the fix.
Missing second-factor step-up enforcement in the Nginx UI cluster API (versions 2.0.0 through 2.4.x) allows anyone holding a valid session token to perform node CRUD operations, read or replace stored node credentials, change namespaces, and trigger cluster-wide Nginx reload or restart actions without re-verifying a one-time password. The api/cluster router is protected by AuthRequired but omits RequireSecureSession, so a stolen or persisted JWT belonging to an OTP-enabled user is sufficient; the flaw is an incomplete fix for CVE-2026-84315 and was corrected in version 2.5.0. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and exposure is limited to clustered/multi-node deployments reachable on the network, so this is a high-priority issue for that specific population rather than a mass-internet emergency.
Attackers who control the Nginx UI upgrade mirror - or hold a man-in-the-middle position on the path to it - can get arbitrary code installed and executed by Nginx UI 2.0.0 through 2.4.x, because the self-upgrade routine verifies the downloaded binary only against a same-origin digest fetched from that same mirror, leaving no independent trust anchor. Exploitation requires two simultaneous conditions: the attacker's mirror/network position must let them alter BOTH the binary and its digest response, and an operator must manually trigger the self-upgrade, at which point the swapped payload is installed and runs in the Nginx UI process context. The issue is rated CVSS 7.5 (AV:N/AC:H/PR:N/UI:R) and is fixed in 2.5.0, which introduces minisign signature verification; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the high network-position prerequisite plus the required operator action substantially narrow realistic exploitation.
Ordinary authenticated users of clustered Nginx UI deployments can read the cluster node token from the JSON responses of /api/nodes and /api/nodes/:id and replay it in the X-Node-Secret header to be authenticated as a trusted peer node, crossing the node-to-node authentication boundary. Because the leaked secret is accepted by AuthRequired and mapped to the synthetic initUser principal, the attacker can reach sensitive management operations on any network-reachable cluster member, including configuration synchronization and service restarts. Affected versions are 2.0.0 through 2.4.x; the issue is fixed in Nginx UI 2.5.0. No public exploit code or confirmed active exploitation was identified at time of analysis, although the upstream fix commit is publicly visible.
Authenticated users of Nginx UI 2.0.0 through 2.4.x who hold permission to create and restore backups can persistently inject modified Nginx configuration or Nginx UI configuration files by crafting a backup archive that carries a symlink pointing at the live configuration path, achieving this even when the restore_nginx and restore_nginx_ui flags are both false. The flaw (CWE-59, link following) stems from the restore path extracting inner archives and materializing symlinks before the restore flags are enforced, so a regular file subsequently written through the staged link lands in the live configuration tree; the resulting tampering takes effect only when those files are later consumed by Nginx, and can produce denial of service. Rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), this requires a valid backup-capable login (PR:L) and is not a remote-unauthenticated attack, and no public exploit code was identified at time of analysis; vendor-released patch: 2.5.0 fully remediates the issue.
Cross-site request forgery in Nginx UI versions 2.0.0 through 2.4.x lets a remote attacker drive a logged-in administrator's browser into performing authenticated, state-changing management operations - including rewriting Nginx configuration through POST /api/configs, triggering config reloads, and invoking other admin endpoints - because the AuthRequired middleware accepts the browser-managed JWT cookie as a valid API credential while management routes generally enforce neither a CSRF token nor Origin/Referer validation. Exploitation requires the victim to be a currently logged-in administrator who is induced to visit an attacker-controlled page (UI:R); per the CVSS vector the attacker needs no credentials of their own (PR:N), but a targeted account protected by OTP/Passkey step-up, or an endpoint requiring secure-session proof, is not exploitable. The attacker cannot read cross-origin responses, so impact is blind configuration tampering and service disruption rather than data exfiltration; the issue is fixed in 2.5.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Account takeover in Nginx UI versions 2.0.0 through 2.4.x affects accounts configured with a passkey as their only second factor: the POST /api/login handler checks EnabledOTP but never requires a WebAuthn assertion when EnabledPasskey is true and no TOTP secret exists, so a valid password alone yields a fully authenticated session despite the account reporting a second factor. An attacker who already holds the account password can reach administrative Nginx UI functionality without possessing the registered passkey; accounts protected by TOTP, and accounts with no 2FA configured, are unaffected. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the AC:H metric reflecting the hard password precondition rather than any exploit complexity.
Credential exposure in Nginx UI 2.0.0 through 2.4.x allows anyone who recovers the Node.Secret master credential to bypass password, JWT, session, and second-factor checks and obtain persistent administrative API access to configuration and secret material. Versions in that range accept the Node.Secret through the node_secret query parameter on HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header, so the credential can leak into access logs, reverse-proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. Exploitation is conditional rather than trivial: node/cluster authentication must actually be in use, the secret must have been transmitted as a query parameter in practice, and the attacker must have read access to one of those sinks; no public exploit code has been identified at time of analysis, and the vendor rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) while our independent assessment scores it AV:N/AC:H/PR:N/UI:N with the same High confidentiality, integrity, and availability impact.
Authenticated administrators of Nginx UI releases 2.3.8 through 2.4.x can achieve remote code execution on the host by abusing the backup restore endpoint to overwrite live configuration with attacker-controlled nginx command settings. The attacker submits attacker-controlled portable backup key material along with a matching manifest to POST /api/restore; because the restore flow trusts the supplied key and treats the backup as 'portable', it decrypts the attacker's payload and replaces the live app.ini, including the protected TestConfigCmd value, after which a call to POST /api/nginx/test executes the restored command inside the Nginx UI runtime. The issue is rated CVSS 9.4 (CVSS 4.0) and CVSS 3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, is fixed in version 2.5.0, and at time of analysis there is no public exploit identified and no confirmed active exploitation (not listed in CISA KEV); the practical barrier is the high-privilege authenticated session required, so exposure is limited to instances where an admin account or session can be obtained by an untrusted party.
Unauthenticated remote clients that can reach the Nginx UI node-signature authentication API on versions 2.5.0 through pre-2.6.0 can force the server to stage attacker-controlled request bodies to temporary files and flush them to disk before any digest or cryptographic signature validation occurs, allowing exhaustion of temporary filesystem capacity, disk I/O, and request-processing resources. The impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) - authentication is not bypassed and there is no confidentiality or integrity impact. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch: 2.6.0, which caps staged node request bodies at 128 MiB and adds a pre-read ContentLength check.
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.
Denial of service in the npm package @angular/router when Server-Side Rendering (SSR) is enabled on Node.js allows an unauthenticated remote attacker to crash the SSR worker by exhausting the V8 old-space heap. Numeric matrix-parameter or outlet names (e.g. /a;990;2522) are stored as array-indexed properties on plain parameter objects, causing V8 to allocate dense HOLEY_ELEMENTS backing stores sized to the largest index, producing roughly 350x memory amplification (~20-25 KB of heap per 11-byte path segment) and a fatal 'JavaScript heap out of memory' error. Exploitation requires the app to run Angular SSR on Node.js, to parse user-controlled URLs directly through @angular/router, and an edge/reverse proxy that forwards semicolons and deep paths; roughly 12-22 concurrent 8 KB-path requests or 50-100 concurrent 1-2 KB-path requests are enough to kill a 256-512 MiB worker. Client-side Angular SPAs without SSR are not affected, and no public exploit code has been identified at time of analysis; the only impact is availability (no confidentiality or integrity impact).
Authentication bypass in the YunoHost sogo_yhn package lets any remote client impersonate an arbitrary SOGo user - including a privileged administrator - by simply sending an HTTP header, with no password required. The package configures SOGo to treat the 'x-webobjects-remote-user' header as a verified identity, and the bundled Nginx reverse proxy does not strip that inbound header, so it reaches the backend untouched; both the vendor CVSS 4.0 score (9.3) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirm unauthenticated, network-reachable, high-impact compromise without user interaction. The flaw is fixed in version 5.8.0~ynh9; no CISA KEV listing is associated with this CVE and no public exploit code was identified at time of analysis, but the trivial attack primitive (single header) and the exposed default configuration make prompt patching or proxy-level header stripping essential.
Broken access control in Nginx Proxy Manager through 2.16.0 lets a non-administrative user who has been granted 'manage' permissions over one or more hosts write arbitrary nginx directives into the advanced_config field, which the backend renders verbatim into the generated proxy host configuration. Because directives such as alias can be injected, an attacker can serve files from arbitrary paths or manipulate routing for the hosts they are assigned, changing the content (C:H) and, to a lesser degree, the integrity of what the proxy returns (I:L), though this is confined to that user's assigned hosts and no victim interaction is required. Exploitation requires an authenticated account with delegated manage rights (PR:L, AV:N), so single-admin deployments are not exposed to a lower-privileged attacker; there is no public exploit code identified and no confirmed active exploitation at time of analysis, and the issue is rated 7.1 on the CVSS 4.0 vector supplied alongside the advisory. An upstream fix exists (PR #5908) that gates advanced_config changes behind an isAdmin check, but no tagged patched release has been independently confirmed.
Missing rate limiting on the authentication API of Nginx Proxy Manager through 2.16.0 allows unauthenticated remote attackers to submit unlimited password guesses to POST /api/tokens and then unlimited TOTP guesses to POST /api/tokens/2fa, ultimately obtaining a valid session and full administrative control of the instance. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV, but the weakness is directly reachable by anyone who can talk to the admin interface, which is commonly internet-exposed on self-hosted deployments. Successful compromise is probabilistic rather than certain: it depends on the target account using a weak or previously-breached password and, where 2FA is enabled, on additionally guessing a rotating six-digit code, which is why our assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is more conservative than the published 9.1 CVSS 4.0 score.
wolfSSL builds that enable the WOLFSSL_TRUST_PEER_CERT macro can be induced to accept a forged clone of a trusted-peer CA, letting a malicious (D)TLS server bypass peer authentication; when OPENSSL_COMPATIBLE_DEFAULTS is also defined the flaw spreads to all CA certificate loading. The vulnerable path is reached through wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(), APIs used by autoconf/distro builds of nginx, haproxy, stunnel, wpa_supplicant, apache httpd, hitch, bind, rsyslog and ffmpeg, and exploitation is unauthenticated over the network (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The practical barrier is that the attacker must already know which certificates the victim loaded before a matching clone can be forged (assessment- and vendor-cited AT:P), so this is a targeted authentication bypass rather than a mass-exploitable one; patches exist upstream but no public exploit code has been identified at time of analysis.
Authenticated low-privilege Froxlor users with subdomain-create rights can inject arbitrary nginx or Apache configuration directives via CRLF sequences in the userinfo component of a subdomain redirect URL, leading to server-wide response hijacking and local file disclosure. The vulnerability affects versions 0 through 2.3.10 (incompletely fixed) and up to version 2.3.12, which contains the complete fix. The independent assessment rates this as a genuine high-priority vulnerability; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Grav CMS before 2.0.25 lets unauthenticated remote attackers read sensitive files - configuration secrets and account password hashes - when the site is served by Microsoft IIS using the bundled webserver-configs/web.config over a case-insensitive filesystem such as NTFS, simply by varying the case of a folder name or extension (for example GET /user/CONFIG/system.YAML) so that none of the case-sensitive URL Rewrite deny rules match. The practical blast radius is narrower than the raw path-bypass suggests: whether a bypassed file is actually returned depends on MIME registration, with .json served by default while .yaml/.yml return HTTP 404.3 on a stock IIS unless a YAML MIME mapping has been added; the equivalent gap in webserver-configs/lighttpd.conf is lower risk because lighttpd typically runs on case-sensitive filesystems, and deployments behind Apache (.htaccess), nginx, Caddy, or the PHP built-in server are not affected. No public exploit identified at time of analysis, and while the vendor-released patch is Grav 2.0.25, upgrading alone is insufficient because the .htaccess installer heal does not rewrite web.config or lighttpd.conf, so operators must manually re-copy the corrected sample files.
Frigate NVR deployments prior to 0.18.0 ship an nginx configuration that routes the prefix-matched location /api/go2rtc/api to the internal go2rtc API behind authentication but without an administrator role check, so any authenticated user holding only a low-privilege 'viewer' account can issue GET requests to that path and read proxied go2rtc data. Reachable subpaths (streams, config, log, stack) disclose internal network addresses, configuration file paths, application logs, goroutine stack traces, and RTSP stream URLs that may embed camera credentials; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) reflects remote, authenticated, read-only disclosure with changed scope, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. This is a genuine but bounded confidentiality issue: non-GET methods are rejected by limit_except GET, so no modification or lateral write is possible, the impact is contingent on RTSP URLs actually containing embedded camera credentials, and instances already upgraded to 0.18.0 are not affected. Authentication requirements are confirmed as authenticated by the CVSS vector (PR:L); unauthenticated attackers and administrators are outside the stated prerequisite set.
Authenticated viewer accounts in Frigate NVR can abuse the WebSocket message handler to invoke admin-only control topics, causing service restarts and disabling security monitoring functions across cameras. The flaw affects all releases prior to 0.17.2 and stems from the nginx authentication subrequest proving identity without conveying role information, so frigate/comms/ws.py forwards client-supplied topics to the dispatcher without any role check (CWE-862, missing authorization). Exploitation requires authentication to be enabled plus valid viewer-level credentials, meaning the realistic threat is an insider or the holder of a leaked or shared low-privilege account rather than an anonymous internet attacker; no public exploit code has been identified at time of analysis, and the vendor-released patch is version 0.17.2.
Authentication bypass in Mailu 2.0 through 2024.06.55 and Mailu helm-charts before 2.7.3 allows unauthenticated remote attackers to spoof the trusted proxy identity via a client-controlled X-Forwarded-By header, bypassing header-based proxy authentication. This affects only deployments with PROXY_AUTH_WHITELIST configured and REAL_IP_HEADER unset; default configurations are not vulnerable. The vendor has released fixes in Mailu 2024.06.55 and helm-charts 2.7.3, and no public exploit has been identified at time of analysis.
Unauthenticated administrator account creation in nginx-ignition affects deployments running versions prior to 2.41.1 that are still in their pre-onboarding state. The endpoint POST /api/users/onboarding/finish is registered as anonymous and, because its "onboarding already completed?" check is not atomic with the subsequent user write, a remote unauthenticated attacker (CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N, base 8.1) who can reach such an instance can create a full ReadWrite administrator account for themselves, and concurrent requests can create multiple admin accounts in a single race. No public exploit identified at time of analysis, and the practical window is narrow: exploitation requires the instance to be network-reachable while deployed but before a legitimate operator has completed onboarding - once onboarding is legitimately finished, the path is guarded.
Unauthenticated denial of service in nginx-ignition 2.29.0 through 2.40.0 lets any remote client that can reach the management API burn roughly 2.4 seconds of server CPU per request by sending a GET whose Accept-Language header is built from underscore-separated malformed language tags, since the gin i18n middleware parses the raw header unconditionally with no size or shape limit. Impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): ten concurrent attackers saturate a ten-core host for the duration of the attack while consuming about 10 MiB/s of upstream bandwidth, with no path to data access or code execution. No public exploit code identified at time of analysis and no CISA KEV entry; the vendor-released patch 2.40.1 fixes the issue.
Cache poisoning in the Open VSX registry allows an unauthenticated remote client to inject attacker-chosen download, signature, and public-key URLs into per-extension metadata that is then served to every other client, so downstream VS Code-compatible editors fetch and install an attacker-supplied VSIX. Exploitation requires the deployment to be reachable directly by clients, or fronted by a reverse proxy that relays rather than overwrites the client's X-Forwarded-Host/X-Forwarded-Proto/X-Forwarded-Prefix headers, with ovsx.server.url left unset and the attacker's source address treated as a trusted proxy (by default only loopback and private ranges are). Because the VSIX download URL, its signature URL and the verifying public key URL are all derived from the same base URL, extension signing provides no protection; poisoned entries persist for the cache lifetime (one hour by default) and spread cluster-wide when ovsx.redis.enabled is set. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the prerequisite is a common default deployment shape, so the risk is real and high rather than theoretical.
Unauthenticated arbitrary file upload in the Paid Downloads WordPress plugin (all versions up to and including 3.15) lets remote attackers bypass authorization and file-type checks in the admin_request_handler function to place attacker-controlled files on the server, which can lead to remote code execution. The flaw is reachable without credentials because is_admin() returns true for requests to /wp-admin/admin-post.php, and the handler performs neither a capability check nor an extension/content validation; per assessment, the AC:H rating reflects that reliable code execution depends on server configuration - Apache deployments with AllowOverride enabled may have retrieval of the uploaded file blocked by a plugin-placed .htaccess, confining dependable RCE to nginx, LiteSpeed, or Apache with AllowOverride None, while the upload and authorization bypass itself succeeds on any stack. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated upload primitive combined with a CVSS 8.1 score makes this a high-priority, patch-dependent risk for any site running the plugin.
Configuration injection in the Froxlor hosting control panel (all versions before 2.2.5) lets an authenticated customer embed literal newline characters in a subdomain redirect URL, which are written verbatim into nginx or Apache vhost configuration files when the privileged cron job rebuilds them. Because the injected lines become active web server directives affecting other hosted domains on the same server, a low-privileged tenant can corrupt configs, cause denial of service, or hijack HTTP responses across co-hosted sites. This is a CWE-93 CRLF/newline-injection flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
TLS certificate verification is disabled by default in Socket Firewall (socketdev/socket-registry-firewall) before version 2.0.0, enabling network-positioned attackers to conduct man-in-the-middle attacks against the firewall's outbound connections to both the Socket API and upstream package registries. When the api_ssl_verify and upstream_ssl_verify keys are omitted from socket.yml, the generated configuration explicitly sets both to false, causing the OpenResty/Lua HTTP client to accept any certificate - including self-signed and untrusted certificates - without chain validation. A successful attacker can substitute malicious package content or alter the allow/block policy decisions the firewall enforces, effectively weaponizing the supply chain security control against the organizations it protects. No public exploit has been identified at time of analysis.
Authentication bypass in Traefik v3.7.0 through v3.7.11 lets remote unauthenticated attackers reach protected Kubernetes backends when an Ingress uses the ingress-nginx compatibility provider with both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The provider generates a host-only 'sibling' router carrying only a non-terminal RedirectRegex middleware that still routes to the protected backend, so a crafted request evades the redirect and is proxied without any annotation-derived middleware. Reported by VulnCheck with a published advisory; no public exploit is identified at time of analysis, though the technique is fully documented and trivially reproducible.
Password-protected live stream bypass in AVideo exposes RTMP stream keys, HLS playlist URLs, and AES-128 decryption keys to unauthenticated remote callers via two compounding failures. The PHP-side stats API (`Live::_getStats()` in `plugin/Live/Live.php`) returns protected transmission credentials regardless of password check outcome - including the hidden_applications branch invoked when `canSeeLiveFromLiveKey()` denies access. Independently, the shipped NGINX configuration leaves the `/live` location serving `.m3u8` playlists, AES-128 segment encryption keys, and `.ts` segments without any `auth_request` directive (the `auth_key_check` in the `.key` block is commented out), allowing full stream decryption without the configured password. No patched version was available at time of the advisory.
Unauthenticated LAN access to the ESPHome Device Builder dashboard on Home Assistant add-on deployments allows any device on the local network to gain host-equivalent control with no credentials. The ingress site, which deliberately skips authentication because the HA supervisor is supposed to authenticate upstream, was bound to 0.0.0.0 instead of loopback and the supervisor gateway. Because the add-on uses host networking for mDNS, this exposed the no-auth site on the host's LAN interface, directly bypassing the supervisor's authentication layer. An attacker with LAN access can run arbitrary Python via external_components at compile time, execute arbitrary shell through compile/validation subprocesses, and read or write arbitrary files in the config and data directories. No public exploit has been identified at time of analysis.
Authenticated administrative users of Okta Access Gateway can achieve arbitrary command execution on the underlying gateway host by storing crafted values in an application's label field, which the product interpolates without sanitization into generated nginx server block configuration. The flaw affects Okta Access Gateway versions prior to 2026.9.1 (CPE cpe:2.3:a:okta:access_gateway), scores CVSS 3.1 base 7.2 (High) with total confidentiality, integrity, and availability impact under vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and requires high-privilege (PR:H) access to the management console to seed the malicious label - no user interaction is needed, and the injected directives take effect when the gateway regenerates and reloads its nginx configuration. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and EPSS is low at 0.36% (29th percentile), so this is best characterized as an admin-to-host privilege-abuse vector rather than a remotely exploitable unauthenticated issue.
Client certificate authentication bypass in Traefik v3.7.0-v3.7.10 allows unauthenticated network clients to reach services protected by the nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" annotation without presenting a valid mTLS client certificate. The flaw stems from a naming collision in the Kubernetes Ingress NGINX provider: when two Ingress objects share the same host, client CA secret, and authentication mode, Traefik's conflict-resolution logic silently falls back to the entry point's default TLS configuration, which imposes no client certificate requirement. No public exploit has been identified at time of analysis, and the issue is fixed in Traefik v3.7.11.
NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching.
Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.
Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to Ingress resources to embed arbitrary NGINX configuration directives through unsanitized annotation fields. The configuration generator passes multiple user-controllable annotation values directly into the generated nginx.conf without sanitization, enabling an attacker to inject directives that create or delete files, disable services, or manipulate NGINX routing behavior. Impact is confined to the Kubernetes control plane; the NGINX data plane itself is not directly reachable through this vulnerability.
Configuration injection in NGINX Gateway Fabric allows authenticated Kubernetes users with CRD or Secret write permissions to embed arbitrary NGINX directives into the generated server configuration. The vulnerability originates in the NGINX configuration generator component, which renders Authentication Filter fields - clientID, cookieName, and clientSecret - directly into configuration templates without sanitization. Successful exploitation is limited to the control plane; no data-plane traffic is directly manipulated, but an attacker can introduce directives that compromise confidentiality and integrity of the NGINX Plus configuration. No public exploit has been identified and the issue is not listed in CISA KEV at time of analysis.
NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern.
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PHP or HTML files with attacker-controlled names to the plugin's temporary upload directory by exploiting chunk-state hash reuse in the `GFAsyncUpload::upload()` function. On NGINX or other non-`.htaccess`-respecting web servers, this leads to remote code execution; on Apache deployments the plugin's bundled `.htaccess` file blocks PHP execution, though attacker-written `.html` files can still produce stored same-origin XSS if a victim visits the generated URL. No public exploit has been identified at time of analysis, and exploitation is meaningfully constrained by two simultaneous prerequisites: a specific form configuration and a non-Apache web server.
Path traversal in Kirby CMS's media handler exposes arbitrary .json file existence and potentially image file contents to remote unauthenticated attackers on affected server configurations. The vulnerability exists in two code paths - Media::thumb() in src/Cms/Media.php and the file::version path in src/Filesystem/Asset.php - both of which failed to reject URL-encoded slash characters or literal ../ sequences before resolving paths relative to validated media directories. Fixed in versions 4.9.5 and 5.5.2; no public exploit code has been identified at time of analysis, and CISA KEV listing is absent.
Remote unauthenticated denial-of-service in alos-http, a Linux amd64 Go web framework, allows any network-reachable client to crash the entire server process with a single malformed HTTP request. The flaw exists in the request-line parser's `sanitizeRequestPath` function, which performs an unchecked index into an empty string after stripping a bare query-string path such as `GET ? HTTP/1.1`. Because the panic fires in the connection-worker goroutine before the handler chain, the framework's own `core.Recovery()` middleware cannot intercept it, making the crash total and immediate. A publicly available proof-of-concept exploit exists; the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated remote destruction of pending-deletion accounts is possible in APITable through 1.13.0-beta.1, where two internal user-management endpoints are reachable by any network client without credentials. The InternalUserController annotates both getUserHistories and closePausedUserAccount with requiredLogin = false, causing ResourceInterceptor to skip all session and API-key validation; the bundled nginx gateway forwards every /api request to the backend, giving external attackers a direct path. An attacker can enumerate accounts in the 30-day deletion cooling-off window and then permanently destroy each one - wiping PII, cancelling subscriptions, removing space memberships, and revoking OAuth bindings - with no possibility of recovery. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in Laravel Backpack CRUD's Stats::makeCurlRequest method allows unauthenticated remote attackers to execute arbitrary OS commands as the web server user by supplying a crafted HTTP Host header. All four maintained branches are affected: 4.1.x before 4.1.72, 5.x before 5.6.2, 6.x before 6.8.13, and 7.x before 7.0.36. No public exploit code or CISA KEV listing exists at time of analysis, but the only in-code guard is a 1-in-100 probabilistic gate that provides no meaningful protection against a determined attacker who can retry requests.
Remote stack-based buffer overflow in the embedded nginx binary (/usr/nginx/sbin/nginx) of the TRENDnet TEW-WLC100 wireless LAN controller, firmware 1v2.07b01, lets remote attackers overflow a fixed-size stack buffer in the HTTP Server-header handling routine FUN_0040da4c. Reported through VulDB with a public proof-of-concept exploit already available, the flaw carries a CVSS 4.0 base score of 9.3 and, per its vector, requires no authentication or user interaction. There is no public exploit identified as being used in active attacks - only a POC exists - but the combination of a network-reachable overflow and released exploit code makes this a high-priority patching candidate.
Customer-uploaded file disclosure in Extra Product Options Builder for WooCommerce (all versions before 1.2.176) allows unauthenticated requesters who know a file's stored name to retrieve it via an unprotected plugin endpoint, bypassing a missing authorization check (CWE-862). The real-world severity is conditional on web server type: the plugin writes deny-all rules to upload directories, meaning this endpoint only crosses a new security boundary on Apache-hosted sites; on default nginx deployments, those files are already directly URL-accessible and the endpoint adds no measurable additional exposure. Publicly available exploit code exists, but no public exploit identified at time of analysis confirms active exploitation, and EPSS sits at 0.22% (12th percentile) despite the elevated CVSS score.
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., `/x/../upload/...`) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. No public exploit has been identified at time of analysis, and CISA has released a fix in v26.07.0.
Authenticated users holding only the granular ROLE_UPLOAD permission in CISA's Malcolm network traffic analysis suite can upload a .php file that the suite's own nginx routes to php-fpm and executes as www-data inside the file-upload container, yielding remote code execution in the file-upload component. The flaw (CWE-434, unrestricted file upload) affects Malcolm versions before 26.06.1 and is reachable only when Malcolm runs in RBAC mode, where the upload endpoint is exposed to the upload-only role; unauthenticated users cannot reach it (CVSS:3.1 PR:L, assessed high impact C:H/I:H/A:H). There is no public exploit code identified at time of analysis and EPSS is low (0.30%, 22nd percentile), while the vendor-released fix is Malcolm 26.06.1.
Cross-user HTTP response poisoning in Traefik's default reverse proxy allows an unauthenticated remote attacker using HTTP/2 or HTTP/3 to smuggle responses into other clients' backend connections, potentially delivering authenticated or private content from one user to another. All supported Traefik branches through v2.11.52, v3.6.23, and v3.7.8 are affected in default configuration when fronting Go net/http or gunicorn/Flask backends, which are confirmed 'armed' (respond to CONNECT with keep-alive non-2xx without draining the body). A proof-of-concept is publicly available demonstrating reliable cross-user poisoning including a cascade scenario where 8 of 8 sequential victims read responses that were not their own; no CISA KEV listing was present at time of analysis.
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endpoints protected by BasicAuth, DigestAuth, or ForwardAuth by exploiting unnormalized dot-segment paths generated by the Kubernetes Ingress NGINX provider's RewriteTarget middleware. When an Ingress path regex captures attacker-controlled text without requiring a path separator (e.g., /api(.*) rewriting to /$1), a crafted request such as /api../admin is rewritten to /../admin and forwarded to a backend that resolves it to /admin - a path secured on a separate Traefik router - entirely bypassing route-level access controls. No public exploit has been identified at time of analysis; a vendor patch is available in v3.7.8.
Remote unauthenticated Denial of Service in Datadog's dd-trace-rb Ruby tracing library (versions before 2.32.0) allows attackers to exhaust CPU and memory by sending HTTP requests with oversized or high-cardinality W3C `baggage` headers. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) limits were enforced only on injection and not extraction, the tracer allocates a hash-map entry per comma-separated pair on every request. Baggage propagation is enabled by default, so any internet-facing instrumented Ruby service is exposed; no public exploit was identified at time of analysis, and this CVE is not listed in CISA KEV.
Remote denial of service in Datadog's dd-trace-go APM library lets unauthenticated attackers exhaust CPU and memory on any instrumented HTTP service by sending an oversized W3C 'baggage' header. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safety limits were enforced only on baggage injection, not extraction, so a single crafted request with a huge number of comma-separated key-value pairs forces one hash-map allocation per pair on every request. Because baggage propagation is enabled by default, any internet-facing Go service using an affected tracer is exposed; there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote unauthenticated Denial of Service in the Datadog.Trace .NET tracing library (versions before 3.43.0) arises because W3C baggage HTTP headers are parsed on the extract path without enforcing the DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits that are only applied during injection. An attacker can send a single request with a baggage header containing an arbitrarily large number of comma-separated key-value pairs, forcing the tracer to allocate a hash-map entry per pair and exhausting CPU and memory. Because the baggage propagation style is enabled by default, any internet-facing service instrumented with an affected tracer is exposed; there is no public exploit identified at time of analysis and the CVSS is 7.5 (A:H only).
Remote unauthenticated Denial of Service in the Datadog dd-trace-js Node.js tracing library (versions < 5.100.0) allows attackers to exhaust CPU and memory by sending an HTTP request with an oversized W3C 'baggage' header. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) caps were enforced only on injection and not on the extraction path, the tracer allocates a hash-map entry per comma-separated pair on every request. With baggage propagation enabled by default, any internet-facing instrumented service is exposed. CVSS 3.1 base score is 7.5 (A:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote denial of service in Datadog's dd-trace-py Python tracing library (versions before 4.8.2) lets unauthenticated attackers exhaust CPU and memory by sending oversized W3C 'baggage' HTTP headers. The DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) safeguards were enforced only on baggage injection, never on extraction, so a single crafted request with a huge number of comma-separated pairs forces the tracer to allocate a hash-map entry per pair on every request. Because the baggage propagation style is enabled by default, any reachable service instrumented with an affected tracer is exposed; no public exploit identified at time of analysis.
Remote denial of service in Datadog's dd-trace-java (dd-java-agent) tracing library affects any HTTP service instrumented with a version below 1.62.0 that has W3C baggage propagation enabled, which is the default. Because the DD_TRACE_BAGGAGE_MAX_ITEMS (64) and DD_TRACE_BAGGAGE_MAX_BYTES (8192) caps were enforced only on baggage injection and not on extraction, a remote unauthenticated attacker can send a single crafted 'baggage' header with a huge number of key-value pairs or one oversized value to exhaust CPU and memory. There is no public exploit identified at time of analysis and it is not on CISA KEV, but exploitation is trivially reliable (CVSS 7.5, AV:N/AC:L/PR:N).
Limited memory disclosure and worker-process restart in NGINX Plus and NGINX Open Source arise when the optional ngx_http_slice_module is compiled in and configured alongside unnamed regex captures, or when a background cache update occurs, letting remote attackers trigger uninitialized memory access (CWE-908) in the data plane. The CVSS:4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with no user interaction, scored 8.8. There is no public exploit identified at time of analysis and no CISA KEV listing; F5 has released a patch and the issue does not affect the control plane.
Heap buffer over-read in the ngx_http_ssi_module of NGINX Open Source and NGINX Plus lets an unauthenticated man-in-the-middle attacker who can control upstream responses corrupt worker-process memory or crash the worker, but only in the non-default configuration combining Server-Side Includes, proxy_pass, and proxy_buffering off. The impact is confined to the data plane with no control-plane exposure, yielding limited memory modification and worker restarts (denial of service) rather than full code execution. No public exploit identified at time of analysis, though a vendor patch is available and the flaw carries a CVSS 4.0 score of 8.3.
Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (DoS) and, on hosts with ASLR disabled or bypassed, potentially execute arbitrary code by sending crafted HTTP requests. The flaw is a data-plane-only issue triggered when a regex-based map directive references the map's regex capture variables before the map output variable in a string expression, or via a non-cacheable variable under certain conditions. F5 has released a patched version; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in F5 NGINX Ingress Controller allows an authenticated remote attacker holding write access to Ingress or TransportServer resources to crash the control plane by submitting a malformed resource. Because the offending resource persists in the cluster, the controller re-reads it and re-crashes, producing a durable crash loop rather than a one-time outage. There is no public exploit identified at time of analysis, and impact is confined to the control plane with no data plane or confidentiality/integrity exposure.
Configuration injection in F5 NGINX Ingress Controller lets an authenticated Kubernetes user with rights to create or modify Ingress CRDs or annotations smuggle arbitrary NGINX directives into the generated configuration. Because multiple user-controllable fields are written to the config without sanitization, an attacker can inject directives that create or delete files and disable services on the control plane. No public exploit identified at time of analysis; this is a control-plane-only issue with no data plane exposure, but the CVSS 4.0 score of 8.7 (High) reflects strong confidentiality and integrity impact.
Remote code execution in the plank/laravel-mediable package before 7.0.0 lets attackers upload a double-extension file such as shell.php.jpg that passes all MIME, extension, and aggregate-type validation because of the trailing .jpg, yet retains an inner .php in its stored basename. On Apache/nginx servers misconfigured to execute any filename containing .php, the stored artifact runs as PHP. Reported by VulnCheck with a vendor patch in 7.0.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
WAF filtering bypass in OWASP ModSecurity (libmodsecurity) before 3.0.16 lets remote unauthenticated attackers smuggle malicious payloads past inspection rules by exploiting a multipart/form-data parser differential. The engine silently strips embedded line breaks from non-file form-field values before populating ARGS and ARGS_POST, so any rule whose detection depends on a newline (e.g. command, header, or injection syntax spanning a line break) fails to match while the backend still receives and acts on the intact payload. No public exploit identified at time of analysis, but the CVSS base score of 8.6 reflects a scope-changing integrity impact on every application shielded by an affected deployment.
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV.
Privilege escalation in Frigate 0.17.1 allows any authenticated user, including low-privilege viewers, to download logs
Single-use authorization-code enforcement can be bypassed under concurrency in the better-auth OAuth provider (@better-auth/oauth-provider 1.6.0 through 1.6.10, the embedded plugin in better-auth 1.4.8-beta.7 through 1.6.10, and the legacy oidc-provider and mcp plugins). Because the POST /oauth2/token authorization_code grant redeems the code via a non-atomic find-then-delete, two concurrent requests carrying the same code both pass the read step and each mint a fresh access, refresh, and id token for the original user's scope. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor rates it CVSS 4.0 7.6 (High) with high confidentiality and integrity impact.
Account takeover in FOSSBilling 0.5.6 through 0.7.2 arises because the reset_password guest API endpoint reuses an existing, unexpired ClientPasswordReset token rather than rotating it on each request. An attacker who has captured a victim's earlier reset link retains a valid path to hijack the account even after the victim requests a fresh reset, since the original token is never invalidated and its 15-minute window is anchored to the first request. No public exploit is identified at time of analysis, and the CVSS 4.0 score is 7.7 (High); version 0.8.0 fixes the flaw.
Arbitrary file read in GravitLauncher LaunchServer ≤ 5.7.11 lets an unauthenticated remote attacker retrieve any file readable by the server process via a path-traversal in the default-enabled HTTP file server on port 9274. Because the exposed files include the ECDSA key that signs access JWTs (.keys/ecdsa_id), the refresh-token salt, and database credentials, the flaw escalates from information disclosure to a full authentication bypass allowing forged admin tokens. Publicly available exploit code exists (a raw-socket PoC in the advisory); the issue is not listed in CISA KEV and no active exploitation is confirmed.
Arbitrary file disclosure and PHP local file inclusion in Cockpit CMS before release 364 lets unauthenticated remote attackers read files outside the web root and, on certain server setups, cause the application to include() attacker-chosen .php files. The flaw stems from unvalidated PATH_INFO (derived from REQUEST_URI) being used to build filesystem paths without containment checks. Publicly available exploit code exists; it is not listed in CISA KEV and no EPSS score was provided.
Arbitrary file upload leading to remote code execution in the Divi Form Builder WordPress plugin (versions through 5.1.8) lets unauthenticated attackers upload executable PHP files and run arbitrary code on the server. Attacker-controlled input from the acceptFileTypes POST parameter is interpolated directly into the file-validation regex in do_image_upload(), allowing alternate PHP extensions (.phtml, .phar, .php5, .php7) that evade the plugin's .php-only .htaccess block - and on Nginx the .htaccess protection does not apply at all. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 9.8 rating and Wordfence's technical disclosure make this a high-priority patching target.
Denial of service in Fluentd (rubygems package, versions <= 1.19.2) lets remote attackers crash the log collector by sending a gzip decompression bomb to the in_http (default port 9880) or in_forward (default port 24224) plugins. Although Fluentd enforces body_size_limit and chunk_size_limit on the compressed payload, it applies no ceiling on the decompressed output, so a tiny crafted payload expands in memory until the OS OOM-kills the process. No public exploit identified at time of analysis and it is not in CISA KEV, but EPSS-style risk is bounded by the requirement that an input port be reachable from an untrusted network.