ModSecurity discloses upload-bypass and crash flaws, one unpatched
One flaw has no listed fix; the pointer bug is reachable only if SecParseXmlIntoArgs is On or OnlyArgs.
Stories per day · 30 days
6 RSS
Relatedf57rce6heap-overflow4patch4denial-of-service3http33cve2remote-code-execution2ubuntu2use-after-free20day1advisory1apache1aslr1authentication-bypass1buffer-overflow1canada1cloudpanel1
21 stories, newest first · one card per story
Stories tagged #nginx
Ubuntu extends nginx security fixes to older LTS releases (USN-8955-2)
The notice also fixes CVE-2026-42533, which can let a remote attacker crash nginx or possibly run code.
Ubuntu: nginx flaws may crash the server or allow code execution
Two named CVEs cover alias-plus-rewrite and regex map handling; a third HTTP/3 issue is only partly described.
Open source nginx before 1.31.7 or 1.30.6 may allow RCE
An oss-security post says at least two F5-published nginx issues may allow remote code execution.
F5 ships emergency patches for three critical NGINX flaws
All three CVEs score 9.2; F5 says it has found no evidence of exploitation and urges upgrades.
F5 ships out-of-band patches for critical NGINX flaws
Three critical bugs can crash NGINX or, if ASLR is off or bypassed, allow code execution; F5 reports no exploitation.
F5 addressed critical RCE flaws in NGINX
F5 patched three critical NGINX flaws that can allow unauthenticated remote code execution.
F5, Juniper Networks Patch Critical Vulnerabilities
F5 and Juniper patched critical NGINX and Junos flaws that can lead to remote code execution.
F5 security advisory (AV26-1049)
Canada’s Cyber Centre urges updates for multiple NGINX and F5 products affected by three new CVEs.
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX 1.30.6 and 1.31.7 fix five flaws, including possible worker RCE and a TLS client-cert bypass.
[0day-rubbish] CloudPanel 2.5.4-3 site-settings rootDirectory nginx virtual-host injection to host root code execution (8.8)
CloudPanel 2.5.4-3 site settings can inject an nginx vhost and run code as root.
Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
Team82 found authentication bypass and remote code execution flaws in Danfoss AK-SM 800A controllers.
Cyber guardrails tax the defender, not the attacker
Winfunc says AI cyber guardrails hinder defenders after an unguarded agent breached Hugging Face in July.
13
Self-hosted HTTP tunnels with SSH and Nginx
A write-up shows self-hosted HTTP tunnels using OpenSSH reverse forwards and nginx signed URLs.
The Truth about GET and HTTP Standards, (Tue, Sep 22nd)
SANS research tests Apache, NGINX, and Python server responses to non-standard HTTP GET requests with a body, finding inconsistent handling.
New Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches
YesWeHack researcher details cache key injection against Nginx, enabling access control bypass, cache poisoning, denial of service, and potential stored XSS.
1
Hackers Can Manipulate Web Cache Keys to Access Restricted Data and Poison Websites
Researcher Alex Brumen demonstrates Nginx cache key injection enabling restricted-data access, cache-poisoned denial of service, and stored XSS.
5
BlackHatSect0r Hackers Disable AI Safety Controls to Automate Credential Theft and Cyberattacks
French-speaking crew BlackHatSect0r disabled AI agent safety controls to automate scanning, credential harvesting, and vishing, exposing 16,834 stolen credentials.
6
USN-8563-5: nginx vulnerability
Ubuntu ships improved nginx fix for CVE-2026-42533 after earlier patch regression; flaw allows remote crash and possible code execution.
F5 security advisory (AV26-878)
Canada's Cyber Centre relayed an F5 advisory (AV26-878) covering vulnerabilities in BIG-IP, BIG-IQ, NGINX components, and APM clients.
ZDI-26-578: NGINX HTTP Dav Module Alias Directive Integer Underflow Remote Code Execution Vulnerability
An unauthenticated integer underflow (CVE-2026-27654, CVSS 8.1) in NGINX's HTTP Dav module alias directive enables remote code execution.