Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: F5 NGINX Plus 37.0.3.1, R36 P7 Clear all filters
TI-2026-42786 CVE-2026-60005 · GHSA-vxcv-h5wj-jxr5

NGINX ngx_http_slice_module vulnerability

Priority MEDIUM 45

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0074 Published 2026-07-15 Partial fix · 37.0.3.1, R36 P7 +2 CWE-908
TI-2026-42806 CVE-2026-60065 · GHSA-w94h-5qpm-994v

NGINX Plus ngx_stream_mqtt_filter_module vulnerability

Priority LOW 28

When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00448 Published 2026-07-15 Fixed in 37.0.3.1, R36 P7 CWE-125
TI-2026-40780 CVE-2026-56434 · GHSA-m73p-xg7q-m8f2

NGINX ngx_http_ssi_module vulnerability

Priority LOW 37

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00486 Published 2026-07-15 Partial fix · 37.0.3.1, R36 P7 +2 CWE-416
TI-2026-30813 CVE-2026-42533 · GHSA-fxfg-v4rj-hp95

NGINX Map directive and Regex matching vulnerability

Priority HIGH 75

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.06296 Published 2026-07-15 Partial fix · 37.0.3.1, R36 P7 +2 CWE-122