Exposición de Nginx

Reverse proxies, Web servers
405
score de exposición
2.081.367
sitios usan
1
en explotación
18
críticos

CVEs

186 resultados
CVE-2026-84319HIGHNginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker contextEPSS 0.3%CVE-2026-28753MEDIUMNGINX ngx_mail_proxy_module vulnerabilityEPSS 0.3%CVE-2026-33031HIGHNginx-UI: Disabled users retain full API access through previously issued bearer tokensEPSS 0.3%CVE-2026-96615HIGHNGINX Gateway Fabric vulnerabilityEPSS 0.3%CVE-2026-90439MEDIUMNGINX ngx_http_v3_module vulnerabilityEPSS 0.3%CVE-2021-23020—The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictaEPSS 0.3%CVE-2026-97629HIGHNGINX ngx_http_ssl_module vulnerabilityEPSS 0.2%CVE-2025-55740MEDIUMDefault Credentials in nginx-defender Configuration FilesEPSS 0.2%CVE-2021-23019—The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included iEPSS 0.2%CVE-2022-41743HIGHNGINX ngx_http_hls_module vulnerability CVE-2022-41743EPSS 0.2%CVE-2021-23021—The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission biEPSS 0.2%CVE-2026-102335HIGHNginx Proxy Manager through 2.16.0 Improper Authorization via advanced_configEPSS 0.2%CVE-2026-107809HIGHNginx-UI AuthRequired token cookie fallback enables CSRF against management APIsEPSS 0.2%CVE-2025-48360MEDIUMWordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-107804MEDIUMNginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockoutEPSS 0.2%CVE-2023-1550MEDIUMNGINX Agent vulnerability CVE-2023-1550EPSS 0.2%CVE-2026-101019HIGHNGINX ngx_http_js_module vulnerabilityEPSS 0.2%CVE-2026-84321MEDIUMNginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enableEPSS 0.2%CVE-2025-12014MEDIUMNGINX Cache Optimizer <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Dynamic Caching Exclusion UpdateEPSS 0.2%CVE-2020-5899—In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text,EPSS 0.2%