Nginx Instance Manager (F5) - vulnerabilities (CVEs)
19 CVEs, 0 in the last 30 days, 45 known versions, newest CVE from 2026-07-15. Vendor: F5.
CVEs of Nginx Instance Manager
- CVE-2026-60005 - CVSS 8.8 (high), 2026-07-15: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured…
- CVE-2026-60062 - CVSS 6.4 (medium), 2026-07-15: The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure…
- CVE-2026-48142 - CVSS 6.3 (medium), 2026-06-17: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with…
- CVE-2026-42055 - CVSS 9.2 (critical), 2026-06-17: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the…
- CVE-2026-42530 - CVSS 9.2 (critical), 2026-06-17: NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote…
- CVE-2026-9256 - CVSS 9.2 (critical), 2026-05-22: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex…
- CVE-2026-42945 - CVSS 9.2 (critical), 2026-05-13: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed…
- CVE-2026-42946 - CVSS 8.3 (high), 2026-05-13: A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.…
- CVE-2026-42934 - CVSS 6.3 (medium), 2026-05-13: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with…
- CVE-2026-42926 - CVSS 6.3 (medium), 2026-05-13: When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to…
- CVE-2026-40701 - CVSS 6.3 (medium), 2026-05-13: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and…
- CVE-2026-40460 - CVSS 6.9 (medium), 2026-05-13: When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for…
- CVE-2026-1642 - CVSS 8.2 (high), 2026-02-04: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a…
- CVE-2024-10318 - CVSS 5.4 (medium), 2024-11-06: A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an…
- CVE-2024-7634 - CVSS 6.9 (medium), 2024-08-22: NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated…
- CVE-2023-28724 - CVSS 7.1 (high), 2023-05-03: NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager…
- CVE-2023-28656 - CVSS 8.1 (high), 2023-05-03: NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. Note: Software…
- CVE-2023-1550 - CVSS 5.5 (medium), 2023-03-29: Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log…
- CVE-2022-35241 - CVSS 6.5 (medium), 2022-08-04: In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource…
