NI
Product
NGINX Ingress Controller
On CISA KEVExploited in the wild
28
CVEs
1
On KEV
8.3
Max CVSS
2
New 30D
Severity mix
Critical 0High 16Medium 12Low 0
Watch
Add NGINX Ingress Controller to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-56434 | 6.5 | Jul 15 | NGINX ngx_http_ssi_module vulnerability Affected: 3.5.0 through 3.7.2; 5.0.0 before 5.5.3; 2026-lts-r1 before 2026-lts-r4; 4.0.0; 4.0.1 |
| CVE-2026-52865 | 6.5 | Jul 15 | NGINX Ingress Controller vulnerability Affected: 5.0.0 before 5.5.2; 2026-lts-r1 before 2026-lts-r3 |
| CVE-2026-40460 | 6.5 | May 13 | NGINX ngx_quic_module vulnerability Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.2 |
| CVE-2022-30535 | 6.5 | Aug 4 | NGINX Ingress Controller vulnerability CVE-2022-30535 Affected: 2.x before 2.3.0; 1.0.0 before 1.x* |
| CVE-2021-23055 | 6.5 | Apr 21 | On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects Affected: 1.0.0 before 1.12.3; 2.0.0 before 2.0.3 |
| CVE-2026-1642 | 5.9 | Feb 4 | A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers Affected: 3.4.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 before 5.3.3 |
| CVE-2026-42926 | 5.8 | May 13 | NGINX ngx_http_proxy_v2_module vulnerability Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.2 |
| CVE-2024-10318 | 5.4 | Nov 6 | A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time Affected: through 1.12.5; 2.2.1 through 2.4.2; 3.0.0 before 3.7.1 |
| CVE-2026-60065 | 5.3 | Jul 15 | NGINX Plus ngx_stream_mqtt_filter_module vulnerability Affected: 3.5.0 through 3.7.2; 5.0.0 before 5.5.3; 2026-lts-r1 before 2026-lts-r4; 4.0.0; 4.0.1 |
| CVE-2026-48142 | 4.8 | Jun 17 | NGINX ngx_http_charset_module vulnerability Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.5.0 |
| CVE-2026-42934 | 4.8 | May 13 | NGINX ngx_http_charset_module vulnerability Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.2 |
| CVE-2026-40701 | 4.8 | May 13 | NGINX ngx_http_ssl_module vulnerability Affected: 3.5.0 through 3.7.2; 4.0.0 through 4.0.1; 5.0.0 through 5.4.2 |
Showing 12