CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 09:00 UTC)

What this means for you

This week: 5,435 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,435; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product f5:nginx_instance_manager. Show all products

13 CVEs, showing 1 to 13

CVE	Severity	Title	Published
CVE-2026-1642	Medium 5.9	A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers.	Feb 4, 2026
CVE-2026-40460	Medium 6.5	When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limi…	May 13, 2026
CVE-2026-40701	Medium 4.8	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or…	May 13, 2026
CVE-2026-42926	Medium 5.8	When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the…	May 13, 2026
CVE-2026-42934	Medium 4.8	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.	May 13, 2026
CVE-2026-42945	High 8.1	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.	May 13, 2026
CVE-2026-42946	High 7.4	A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data.	May 13, 2026
CVE-2026-9256	High 8.1	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.	May 22, 2026
CVE-2026-42055	High 8.1	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules.	Jun 17, 2026
CVE-2026-42530	High 8.1	NGINX Open Source has a vulnerability in the ngx_http_v3_module module.	Jun 17, 2026
CVE-2026-48142	Medium 4.8	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module.	Jun 17, 2026
CVE-2026-60062	Medium 6.4	The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory.	Jul 15, 2026
CVE-2026-60005	High 8.2	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module.	Jul 15, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.