NGINX Rift: an 18-year-old flaw in the world's most deployed web server just came to light
60
60
60
30
30
30
30
60
60
Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover
60
42
60
35
60
60
60
45
60
30
42
30
April 2026 CVE Landscape
60
60
30
60
30
60
30
60
60
USN-8563-5: nginx vulnerability
Ubuntu ships improved nginx fix for CVE-2026-42533 after earlier patch regression; flaw allows remote crash and possible code execution.
USN-8563-5 provides a better fix for CVE-2026-42533 after the original fix from USN-8563-1 was backed out in USN-8563-2 because it caused a regression. The flaw stems from nginx incorrectly handling certain map directives using regex matching and capture variables, allowing a remote attacker to crash nginx, causing denial of service, or possibly execute arbitrary code. The original advisory also described a use-after-free in the ngx_http_ssi_module when configured with Server-Side Includes, proxy_pass, and proxy buffering.
30
30
60
47
30
60
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE
60
30
60
ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability
An unauthenticated integer underflow (CVE-2026-27654, CVSS 8.1) in NGINX's HTTP Dav module alias directive enables remote code execution.
ZDI advisory ZDI-26-578 describes an integer underflow in the alias directive of the NGINX HTTP Dav module that allows remote attackers to execute arbitrary code. Authentication is not required to exploit the vulnerability. ZDI rated the issue 8.1 on CVSS and assigned CVE-2026-27654.
30