NG
Product
NGINX
On CISA KEVExploited in the wild
41
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 13Medium 6Low 0
Watch
Add NGINX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-9516 | 6.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service Affected: 1.9.5 before 1.16.1; 1.17.0 through 1.17.2 |
| CVE-2018-16845 | 6.1 | Nov 7 | nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker… Affected: 1.0.7 through 1.0.15; 1.1.3 through 1.15.5 |
| CVE-2019-20372 | 5.3 | Jan 9 | NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in… Affected: before 1.17.7 |
| CVE-2016-0747 | 5.3 | Feb 15 | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process… Affected: 0.6.18 before 1.8.1; 1.9.0 before 1.9.10 |
| CVE-2011-4968 | 4.8 | Nov 19 | nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM) Affected: 0.7.61; 0.7.62; 0.7.64; 0.7.65; 0.7.66; 0.8.33; +4 more |
| CVE-2025-23419 | 4.3 | Feb 5 | When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements… Affected: 1.11.4 before 1.26.3; 1.27.0 before 1.27.4 |
Showing 6