25
CVEs
4
Critical
13
High
0
KEV
4
PoC
6
Unpatched C/H
68.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
13
MEDIUM
8
LOW
0
Monthly CVE Trend
Affected Products (30)
Njs
38
Roxy Wi
30
Kubernetes
28
Docker
25
Nginx Plus
25
Nginx Open Source
23
Debian Linux
23
PHP
22
Nginx Ui
17
Nginx Controller
17
Fedora
12
Python
12
Ubuntu Linux
10
Nginx Ingress Controller
10
Opensuse
10
Modsecurity
8
Node.js
8
Nginx Instance Manager
8
Leap
8
Xcode
7
Traefik
7
Nginx Proxy Manager
7
Wordpress Plugin
7
Cloud Backup
5
Java
5
Discourse
5
Ingress Nginx
5
Nginx Gateway Fabric
5
Software Collections
4
Traffic Server
4
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75784 | Remote stack-based buffer overflow in the embedded nginx binary (/usr/nginx/sbin/nginx) of the TRENDnet TEW-WLC100 wireless LAN controller, firmware 1v2.07b01, lets remote attackers overflow a fixed-size stack buffer in the HTTP Server-header handling routine FUN_0040da4c. Reported through VulDB with a public proof-of-concept exploit already available, the flaw carries a CVSS 4.0 base score of 9.3 and, per its vector, requires no authentication or user interaction. There is no public exploit identified as being used in active attacks - only a POC exists - but the combination of a network-reachable overflow and released exploit code makes this a high-priority patching candidate. | CRITICAL | 9.3 | 1.0% | 68 |
PoC
No patch
|
| CVE-2026-59177 | Unauthenticated LAN access to the ESPHome Device Builder dashboard on Home Assistant add-on deployments allows any device on the local network to gain host-equivalent control with no credentials. The ingress site, which deliberately skips authentication because the HA supervisor is supposed to authenticate upstream, was bound to 0.0.0.0 instead of loopback and the supervisor gateway. Because the add-on uses host networking for mDNS, this exposed the no-auth site on the host's LAN interface, directly bypassing the supervisor's authentication layer. An attacker with LAN access can run arbitrary Python via external_components at compile time, execute arbitrary shell through compile/validation subprocesses, and read or write arbitrary files in the config and data directories. No public exploit has been identified at time of analysis. | HIGH | 8.8 | – | 64 |
PoC
|
| CVE-2026-55484 | Remote unauthenticated denial-of-service in alos-http, a Linux amd64 Go web framework, allows any network-reachable client to crash the entire server process with a single malformed HTTP request. The flaw exists in the request-line parser's `sanitizeRequestPath` function, which performs an unchecked index into an empty string after stripping a bare query-string path such as `GET ? HTTP/1.1`. Because the panic fires in the connection-worker goroutine before the handler chain, the framework's own `core.Recovery()` middleware cannot intercept it, making the crash total and immediate. A publicly available proof-of-concept exploit exists; the vulnerability is not currently listed in the CISA KEV catalog. | HIGH | 7.5 | 0.3% | 58 |
PoC
|
| CVE-2026-90937 | Configuration injection in the Froxlor hosting control panel (all versions before 2.2.5) lets an authenticated customer embed literal newline characters in a subdomain redirect URL, which are written verbatim into nginx or Apache vhost configuration files when the privileged cron job rebuilds them. Because the injected lines become active web server directives affecting other hosted domains on the same server, a low-privileged tenant can corrupt configs, cause denial of service, or hijack HTTP responses across co-hosted sites. This is a CWE-93 CRLF/newline-injection flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.4 | 0.3% | 47 |
|
| CVE-2026-88877 | Authentication bypass in Traefik v3.7.0 through v3.7.11 lets remote unauthenticated attackers reach protected Kubernetes backends when an Ingress uses the ingress-nginx compatibility provider with both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The provider generates a host-only 'sibling' router carrying only a non-terminal RedirectRegex middleware that still routes to the protected backend, so a crafted request evades the redirect and is proxied without any annotation-derived middleware. Reported by VulnCheck with a published advisory; no public exploit is identified at time of analysis, though the technique is fully documented and trivially reproducible. | CRITICAL | 9.3 | 0.4% | 47 |
No patch
|
| CVE-2026-88011 | ForwardAuth identity spoofing in Traefik allows authenticated network users to impersonate arbitrary identities on normalization-prone backends by sending dot-form HTTP headers (e.g., X.Authenticated.User) that Go's net/http layer treats as distinct from their dash-form equivalents (X-Authenticated-User), while CGI, WSGI, PHP, and NGINX backends collapse both into the same environment variable. Affected deployments span the 2.x branch below v2.11.56 and the 3.x branch from 3.0.0 through 3.7.12; the protective aliasHeadersStrategy option defaults to keep, meaning all unpatched deployments with ForwardAuth and normalization-prone backends are exposed without any additional misconfiguration. No public exploit code and no CISA KEV listing have been identified at time of analysis. | MEDIUM | 5.3 | 0.2% | 47 |
PoC
|
| CVE-2026-78689 | Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis. | CRITICAL | 9.2 | 0.4% | 46 |
|
| CVE-2026-18329 | NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern. | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-80208 | Unauthenticated remote destruction of pending-deletion accounts is possible in APITable through 1.13.0-beta.1, where two internal user-management endpoints are reachable by any network client without credentials. The InternalUserController annotates both getUserHistories and closePausedUserAccount with requiredLogin = false, causing ResourceInterceptor to skip all session and API-key validation; the bundled nginx gateway forwards every /api request to the backend, giving external attackers a direct path. An attacker can enumerate accounts in the 30-day deletion cooling-off window and then permanently destroy each one - wiping PII, cancelling subscriptions, removing space memberships, and revoking OAuth bindings - with no possibility of recovery. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-78222 | NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-77180 | Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to Ingress resources to embed arbitrary NGINX configuration directives through unsanitized annotation fields. The configuration generator passes multiple user-controllable annotation values directly into the generated nginx.conf without sanitization, enabling an attacker to inject directives that create or delete files, disable services, or manipulate NGINX routing behavior. Impact is confined to the Kubernetes control plane; the NGINX data plane itself is not directly reachable through this vulnerability. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-88874 | Password-protected live stream bypass in AVideo exposes RTMP stream keys, HLS playlist URLs, and AES-128 decryption keys to unauthenticated remote callers via two compounding failures. The PHP-side stats API (`Live::_getStats()` in `plugin/Live/Live.php`) returns protected transmission credentials regardless of password check outcome - including the hidden_applications branch invoked when `canSeeLiveFromLiveKey()` denies access. Independently, the shipped NGINX configuration leaves the `/live` location serving `.m3u8` playlists, AES-128 segment encryption keys, and `.ts` segments without any `auth_request` directive (the `auth_key_check` in the `.key` block is commented out), allowing full stream decryption without the configured password. No patched version was available at time of the advisory. | HIGH | 8.7 | 0.5% | 44 |
No patch
|
| CVE-2026-66362 | Configuration injection in NGINX Gateway Fabric allows authenticated Kubernetes users with CRD or Secret write permissions to embed arbitrary NGINX directives into the generated server configuration. The vulnerability originates in the NGINX configuration generator component, which renders Authentication Filter fields - clientID, cookieName, and clientSecret - directly into configuration templates without sanitization. Successful exploitation is limited to the control plane; no data-plane traffic is directly manipulated, but an attacker can introduce directives that compromise confidentiality and integrity of the NGINX Plus configuration. No public exploit has been identified and the issue is not listed in CISA KEV at time of analysis. | HIGH | 8.6 | 0.3% | 43 |
|
| CVE-2026-75594 | Path traversal in Kirby CMS's media handler exposes arbitrary .json file existence and potentially image file contents to remote unauthenticated attackers on affected server configurations. The vulnerability exists in two code paths - Media::thumb() in src/Cms/Media.php and the file::version path in src/Filesystem/Asset.php - both of which failed to reject URL-encoded slash characters or literal ../ sequences before resolving paths relative to validated media directories. Fixed in versions 4.9.5 and 5.5.2; no public exploit code has been identified at time of analysis, and CISA KEV listing is absent. | HIGH | 8.2 | 0.5% | 42 |
|
| CVE-2026-85596 | Client certificate authentication bypass in Traefik v3.7.0-v3.7.10 allows unauthenticated network clients to reach services protected by the nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" annotation without presenting a valid mTLS client certificate. The flaw stems from a naming collision in the Kubernetes Ingress NGINX provider: when two Ingress objects share the same host, client CA secret, and authentication mode, Traefik's conflict-resolution logic silently falls back to the entry point's default TLS configuration, which imposes no client certificate requirement. No public exploit has been identified at time of analysis, and the issue is fixed in Traefik v3.7.11. | HIGH | 8.2 | 0.2% | 41 |
No patch
|