Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.8The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7…Oct 16, 2026
- High8.1Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing CredentialsOct 15, 2026
- Unknownnginx-1.31.7-1.1 on GA mediaOct 15, 2026
- UnknownNginx UI: OTP secure-session step-up can be bypassed via MCP configuration toolsOct 15, 2026
- UnknownNginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enableOct 15, 2026
- UnknownNginx UI: MCP Bypasses Directive Validation — Authenticated RCEOct 15, 2026
- UnknownNginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)Oct 15, 2026
- UnknownNginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)Oct 15, 2026
- UnknownNginx UI: Account Takeover via Missing on User Management EndpointOct 15, 2026
- High8.3Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to au…EPSS 0.2%Oct 14, 2026
- Critical9.2A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return direct…EPSS 0.5%Oct 14, 2026
- High8.7Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAutEPSS 0.4%Oct 14, 2026
- High8.3Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the builtEPSS 0.2%Oct 14, 2026
- Medium6.9Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanuEPSS 0.3%Oct 14, 2026
- Medium6.9NGINX ngx_http_v3_module vulnerabilityEPSS 0.2%Oct 14, 2026
- High8.7An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the policy or Ingress external authentication.EPSS 0.4%Oct 14, 2026
- High7.1Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent.EPSS 0.3%Oct 14, 2026
- High8.8Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unEPSS 0.5%Oct 14, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.EPSS 0.4%Oct 14, 2026
- Critical9.2NGINX map directive and regex matching vulnerabilityEPSS 0.6%Oct 14, 2026
- High7.1Nginx UI is a web user interface for the Nginx web server.EPSS 0.2%Oct 12, 2026
- High8.8Nginx UI is a web user interface for the Nginx web server.Oct 12, 2026
- High8.3Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker contextOct 12, 2026
- Medium6.3Nginx UI: Auto backup name allows path traversal outside validated storage pathOct 12, 2026
- High8.3Nginx UI OTP secure-session step-up is missing on sensitive mutation routesOct 12, 2026
97 records · page 1 of 4
PreviousNext