Login Request a demo
NI
Product
NGINX Ingress Controller
by F5 · last CVE Oct 14, 2026
On CISA KEVExploited in the wild
28
CVEs
1
On KEV
8.3
Max CVSS
2
New 30D
Vulnerabilities28In the news9Timeline
Severity mix
Critical 0High 16Medium 12Low 0
Severity
All severities28Critical0High16Medium12Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add NGINX Ingress Controller to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-44487
In wildKEV
7.5
100%
Oct 10
HTTP/2 Rapid Reset Attack Vulnerability
Affected: 2.0.0 through 2.4.2; 3.0.0 through 3.3.0
CVE-2026-77180
8.3
0%
Sep 2
NGINX Ingress Controller vulnerability
Affected: 5.0.0 before 5.6.0; 2026-lts-r1 before 2026-lts-r5
CVE-2026-55723
8.3
1%
Jul 15
NGINX Ingress Controller vulnerability
Affected: 5.0.0 before 5.5.2; 2026-lts-r1 before 2026-lts-r3
CVE-2025-14727
8.3
0%
Dec 17
A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation
Affected: 5.3.0
CVE-2026-60005
8.2
1%
Jul 15
NGINX ngx_http_slice_module vulnerability
Affected: 3.5.0 through 3.7.2; 5.0.0 before 5.5.3; 2026-lts-r1 before 2026-lts-r4; 4.0.0; 4.0.1
CVE-2026-42533
8.1
1%
Jul 15
NGINX Map directive and Regex matching vulnerability
Affected: 3.5.0 through 3.7.2; 5.0.0 before 5.5.3; 2026-lts-r1 before 2026-lts-r4; 4.0.0; 4.0.1
CVE-2026-42055
8.1
7%
Jun 17
NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability
Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.5.0
CVE-2026-42530
8.1
6%
Jun 17
NGINX Open-Source ngx_http_v3_module vulnerability
Affected: 3.5.0 through 3.7.2; 5.0.0 before 5.5.1; 4.0.0; 4.0.1
CVE-2026-9256
8.1
11%
May 22
NGINX ngx_http_rewrite_module vulnerability
Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 before 5.4.3
CVE-2026-42945
8.1
68%
May 13
NGINX ngx_http_rewrite_module vulnerability
Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.1
CVE-2022-41741
7.8
1%
Oct 19
NGINX ngx_http_mp4_module vulnerability CVE-2022-41741
Affected: 1.9.0 through 1.12.4; 2.0.0 through 2.4.0
CVE-2026-104939
7.5
0%
Oct 14
NGINX Ingress Controller vulnerability
Affected: 5.6.0 before 5.7.0
CVE-2026-94197
7.5
0%
Oct 14
NGINX Ingress Controller vulnerability
Affected: 5.5.0 before 5.7.0
CVE-2026-42946
7.4
1%
May 13
NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability
Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.2
CVE-2022-41742
7.1
1%
Oct 19
NGINX ngx_http_mp4_module vulnerability CVE-2022-41742
Affected: 1.9.0 through 1.12.4; 2.0.0 through 2.4.0
CVE-2022-41743
7.0
0%
Oct 19
NGINX ngx_http_hls_module vulnerability CVE-2022-41743
Affected: 1.9.0 through 1.12.4; 2.0.0 through 2.4.0
CVE-2026-56434
6.5
0%
Jul 15
NGINX ngx_http_ssi_module vulnerability
Affected: 3.5.0 through 3.7.2; 5.0.0 before 5.5.3; 2026-lts-r1 before 2026-lts-r4; 4.0.0; 4.0.1
CVE-2026-52865
6.5
1%
Jul 15
NGINX Ingress Controller vulnerability
Affected: 5.0.0 before 5.5.2; 2026-lts-r1 before 2026-lts-r3
CVE-2026-40460
6.5
0%
May 13
NGINX ngx_quic_module vulnerability
Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.2
CVE-2022-30535
6.5
1%
Aug 4
NGINX Ingress Controller vulnerability CVE-2022-30535
Affected: 2.x before 2.3.0; 1.0.0 before 1.x*
CVE-2021-23055
6.5
1%
Apr 21
On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects
Affected: 1.0.0 before 1.12.3; 2.0.0 before 2.0.3
CVE-2026-1642
5.9
0%
Feb 4
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers
Affected: 3.4.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 before 5.3.3
CVE-2026-42926
5.8
0%
May 13
NGINX ngx_http_proxy_v2_module vulnerability
Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.2
CVE-2024-10318
5.4
0%
Nov 6
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time
Affected: through 1.12.5; 2.2.1 through 2.4.2; 3.0.0 before 3.7.1
CVE-2026-60065
5.3
0%
Jul 15
NGINX Plus ngx_stream_mqtt_filter_module vulnerability
Affected: 3.5.0 through 3.7.2; 5.0.0 before 5.5.3; 2026-lts-r1 before 2026-lts-r4; 4.0.0; 4.0.1
CVE-2026-48142
4.8
1%
Jun 17
NGINX ngx_http_charset_module vulnerability
Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.5.0
CVE-2026-42934
4.8
1%
May 13
NGINX ngx_http_charset_module vulnerability
Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.2
CVE-2026-40701
4.8
1%
May 13
NGINX ngx_http_ssl_module vulnerability
Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.2
Showing 28