Exposure of Nginx

Reverse proxies, Web servers
405
exposure score
2,081,367
sites use
1
exploited
18
critical

CVEs

186 results
CVE-2026-24514MEDIUMingress-nginx Admission Controller denial of serviceEPSS 0.5%CVE-2026-55723HIGHNGINX Ingress Controller vulnerabilityEPSS 0.5%CVE-2026-84316HIGHNginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)EPSS 0.5%CVE-2026-52865HIGHNGINX Ingress Controller vulnerabilityEPSS 0.5%CVE-2026-77180HIGHNGINX Ingress Controller vulnerabilityEPSS 0.5%CVE-2026-50107HIGHNGINX Gateway Fabric vulnerabilityEPSS 0.5%CVE-2026-56434HIGHNGINX ngx_http_ssi_module vulnerabilityEPSS 0.5%CVE-2026-91184HIGHNGINX Gateway Fabric vulnerabilityEPSS 0.5%CVE-2026-84317HIGHNginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)EPSS 0.5%CVE-2020-5867—In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packageEPSS 0.5%CVE-2024-7634MEDIUMNGINX Agent VulnerabilityEPSS 0.5%CVE-2026-107805HIGHNginx UI: Unauthenticated signed-request body staging can exhaust temporary storageEPSS 0.5%CVE-2021-23050—On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3EPSS 0.5%CVE-2026-93964MEDIUMNginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authenticationEPSS 0.5%CVE-2026-102334CRITICALNginx Proxy Manager through 2.16.0 Missing Brute-Force ProtectionEPSS 0.5%CVE-2020-5900—In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX ControlleEPSS 0.5%CVE-2026-60065MEDIUMNGINX Plus ngx_stream_mqtt_filter_module vulnerabilityEPSS 0.4%CVE-2026-107810HIGHNginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are appliedEPSS 0.4%CVE-2025-53859MEDIUMNGINX ngx_mail_smtp_module vulnerabilityEPSS 0.4%CVE-2026-107811HIGH0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUserEPSS 0.4%