Nginx Nginx

Name: Nginx Nginx
Brand: Nginx

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

2critical14high14medium0low

updated 2026-10-28

vulnerabilities (39)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-42945US	—	68.0% (99th)	Exploit	no fix	2026-05-13	≤ vers:unknown/*
CVE-2017-7529US	high7.5	62.6% (99th)	Exploit	no fix	2017-07-13	≤ 0.5.6 - 1.13.2
CVE-2021-23017US	high7.7	53.5% (99th)	Exploit	1.21.0	2021-06-01	< 1.21.0
CVE-2026-33032US	—OT elevated	35.3% (98th)	Exploit	no fix	2026-03-30	≤ UI <2.3.4
CVE-2019-20372US	medium5.3	15.0% (97th)	Exploit	1.17.7	2020-01-09	< 1.17.7
CVE-2026-42055US	—	6.54% (94th)	Exploit	no fix	2026-06-17	3 versions
CVE-2026-42530US	—	6.45% (94th)	Exploit	no fix	2026-06-17	2 versions
CVE-2025-23419US	—OT elevated	2.79% (86th)	Exploit	no fix	2025-02-05	2 versions
CVE-2026-15176US	high8.1	0.84% (58th)	Exploit	no fix	2026-10-14	9 versions
CVE-2026-97205US	high8.1	0.83% (57th)	Exploit	no fix	2026-10-14	9 versions
CVE-2022-41741US	high7.8	0.81% (57th)	Exploit	no fix	2022-10-19	6 versions
CVE-2026-42926US	—	0.35% (28th)	Exploit	no fix	2026-05-13	2 versions
CVE-2026-97629US	medium6.5	0.23% (14th)	Exploit	no fix	2026-10-14	9 versions
CVE-2011-4968US	medium4.8	3.99% (90th)	—	no fix	2019-11-19	≤ through 1.6.2
CVE-2022-41742US	high7.1	1.18% (68th)	—	no fix	2022-10-19	6 versions
CVE-2024-24989US	high7.5	1.06% (64th)	—	1.25.4	2024-02-14	< 1.25.4
CVE-2026-93479US	high8.1	1.01% (63rd)	—	no fix	2026-10-14	9 versions
CVE-2026-33029US	medium6.5	0.98% (62nd)	—	no fix	2026-03-30	≤ UI <2.3.4
CVE-2024-24990US	high7.5	0.91% (60th)	—	1.25.4	2024-02-14	< 1.25.4
CVE-2026-48142US	—	0.68% (52nd)	—	no fix	2026-06-17	3 versions
CVE-2026-11311US	medium6.5	0.57% (47th)	—	no fix	2026-06-17	≤ Gateway Fabric <2.6.4
CVE-2026-33028US	high7.5	0.55% (46th)	—	no fix	2026-03-30	≤ UI <2.3.4
CVE-2026-50107US	—	0.49% (42nd)	—	no fix	2026-06-17	≤ Gateway Fabric <2.6.4
CVE-2026-91184US	high8.8	0.48% (41st)	—	no fix	2026-10-14	≤ Gateway Fabric <2.8.0
CVE-2024-7634US	medium4.9	0.47% (41st)	—	no fix	2024-08-22	2 versions
CVE-2026-33027US	medium6.5	0.41% (35th)	—	no fix	2026-03-30	≤ UI <2.3.4
CVE-2026-94197US	high7.5	0.39% (33rd)	—	no fix	2026-10-14	≤ Ingress Controller <5.7.0
CVE-2026-104939US	high7.5	0.38% (31st)	—	no fix	2026-10-14	≤ Ingress Controller <5.7.0
CVE-2024-10318US	medium5.4	0.37% (31st)	—	no fix	2024-11-06	3 versions
CVE-2026-95101US	medium5.3	0.35% (28th)	—	no fix	2026-10-14	9 versions
CVE-2026-33026US	critical9.1OT elevated	0.33% (27th)	—	no fix	2026-03-30	≤ UI <2.3.4
CVE-2024-7347US	medium4.7	0.32% (25th)	—	no fix	2024-08-14	2 versions
CVE-2026-101025US	medium5.3	0.32% (24th)	—	no fix	2026-10-14	≤ JavaScript (njs) <1.0.2
CVE-2026-32682US	—	0.29% (22nd)	—	no fix	2026-06-17	≤ Gateway Fabric <2.6.4
CVE-2026-33030US	critical9.9	0.29% (21st)	—	no fix	2026-03-30	≤ UI <2.3.4
CVE-2026-96615US	medium6.5	0.26% (17th)	—	no fix	2026-10-14	≤ Gateway Fabric <2.8.0
CVE-2026-90439US	medium6.5	0.26% (17th)	—	no fix	2026-09-15	2 versions
CVE-2022-41743US	high7.0	0.23% (14th)	—	no fix	2022-10-19	6 versions
CVE-2026-101019US	medium6.5	0.21% (11th)	—	no fix	2026-10-14	≤ JavaScript (njs) <1.0.2

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-122Heap-based Buffer Overflow5 CVEs
CWE-787Out-of-bounds Write4 CVEs
CWE-416Use After Free3 CVEs
CWE-76Improper Neutralization of Equivalent Special Elements3 CVEs
CWE-125Out-of-bounds Read2 CVEs
CWE-131Incorrect Calculation of Buffer Size2 CVEs
CWE-172Encoding Error2 CVEs
CWE-20Improper Input Validation2 CVEs

sources (3)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)36 CVEs
EUEU Vulnerability Database (ENISA)2 CVEs
NLNCSC-NL (CSAF)1 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan