Exposición de Nginx

Reverse proxies, Web servers
405
score de exposición
2.081.367
sitios usan
1
en explotación
18
críticos

CVEs

186 resultados
CVE-2026-42055CRITICALNGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerabilityEPSS 6.5%CVE-2026-42533CRITICALNGINX Map directive and Regex matching vulnerabilityEPSS 6.3%CVE-2026-42530CRITICALNGINX Open-Source ngx_http_v3_module vulnerabilityEPSS 6.2%CVE-2024-22198HIGHAuthenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)EPSS 4.1%CVE-2011-4968—nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)EPSS 4.0%CVE-2025-24513MEDIUMingress-nginx controller - auth secret file path traversal vulnerabilityEPSS 3.3%CVE-2020-7621—strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmdEPSS 3.0%CVE-2024-3739MEDIUMcym1102 nginxWebUI upload os command injectionEPSS 2.9%CVE-2025-23419MEDIUMTLS Session Resumption VulnerabilityEPSS 2.8%CVE-2023-5043HIGHIngress nginx annotation injection causes arbitrary command executionEPSS 2.5%CVE-2021-25742HIGHIngress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespacesEPSS 2.1%CVE-2020-27730—In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.EPSS 1.7%CVE-2022-4886HIGHIngress-nginx `path` sanitization can be bypassed with `log_format` directiveEPSS 1.7%CVE-2021-21335MEDIUMBasic Authentication can be bypassed using a malformed usernameEPSS 1.7%CVE-2024-22197HIGHAuthenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)EPSS 1.5%CVE-2026-4342HIGHingress-nginx comment-based nginx configuration injectionEPSS 1.5%CVE-2020-5901—In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user iEPSS 1.5%CVE-2021-25746HIGHIngress-nginx directive injection via annotationsEPSS 1.4%CVE-2026-42221HIGHnginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin ClaimEPSS 1.3%CVE-2026-93479CRITICALNGINX map directive and regex matching vulnerabilityEPSS 1.2%