F5 NGINX Plus
37 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-95101 | 37.1.0 – < 37.2.0.1 ; 37.0.0 – < 37.0.7.1 ; ≥ R36 ; … | NGINX ngx_http_v3_module vulnerability | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-97205 | 37.1.0 – < 37.1.0.1 ; 37.0.0 – < 37.0.5.1 ; ≥ R36 ; … | NGINX ngx_http_core_module vulnerability | CRITICAL 9.2 | 0.8 % | ||
| CVE-2026-93479 | 37.1.0 – < 37.1.0.1 ; 37.0.0 – < 37.0.5.1 ; ≥ R36 ; … | NGINX map directive and regex matching vulnerability | CRITICAL 9.2 | 1.2 % | ||
| CVE-2026-97629 | 37.1.0 – < 37.1.0.1 ; 37.0.0 – < 37.0.5.1 ; ≥ R36 ; … | NGINX ngx_http_ssl_module vulnerability | HIGH 8.3 | 0.2 % | ||
| CVE-2026-15176 | 37.1.0 – < 37.1.0.1 ; 37.0.0 – < 37.0.5.1 ; ≥ R36 ; … | NGINX ngx_http_core_module vulnerability | CRITICAL 9.2 | 0.8 % | ||
| CVE-2026-90439 | 37.1.0.1 – < 37.1.1.2 ; 37.0.0.1 – < 37.0.6.2 | NGINX ngx_http_v3_module vulnerability | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-60005 | 37.0.0.1 – < 37.0.3.1 ; R36 – < R36 P7 ; ≥ R33 | NGINX ngx_http_slice_module vulnerability | HIGH 8.8 | 0.5 % | ||
| CVE-2026-60065 | 37.0.0.1 – < 37.0.3.1 ; R36 – < R36 P7 ; ≥ R33 | NGINX Plus ngx_stream_mqtt_filter_module vulnerability | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-56434 | 37.0.0.1 – < 37.0.3.1 ; R36 – < R36 P7 ; ≥ R33 | NGINX ngx_http_ssi_module vulnerability | HIGH 8.3 | 0.4 % | ||
| CVE-2026-42533 | 37.0.0.1 – < 37.0.3.1 ; R36 – < R36 P7 ; ≥ R33 | NGINX Map directive and Regex matching vulnerability | CRITICAL 9.2 | 0.9 % | ||
| CVE-2026-48142 | 37.0 – < 37.0.2.1 ; R36 – < R36 P6 | NGINX ngx_http_charset_module vulnerability | MEDIUM 6.3 | 0.7 % | ||
| CVE-2026-42055 | 37.0 – < 37.0.2.1 ; R36 – < R36 P6 | NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability | CRITICAL 9.2 | 6.5 % | ||
| CVE-2026-9256 | 37.0 – < 37.0.1.1 ; R36 – < R36 P5 ; R32 – < R32 P7 | NGINX ngx_http_rewrite_module vulnerability | CRITICAL 9.2 | 11 % | ||
| CVE-2026-40460 | R36 – < R36 P4 ; R32 – < R32 P6 | NGINX ngx_quic_module vulnerability | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-42946 | R36 – < R36 P4 ; R32 – < R32 P6 | NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability | HIGH 8.3 | 0.9 % | ||
| CVE-2026-42934 | R36 – < R36 P4 ; R32 – < R32 P6 | NGINX ngx_http_charset_module vulnerability | MEDIUM 6.3 | 0.7 % | ||
| CVE-2026-42945 | R36 – < R36 P4 ; R32 – < R32 P6 | NGINX ngx_http_rewrite_module vulnerability | CRITICAL 9.2 | 68 % | ||
| CVE-2026-40701 | R36 – < R36 P4 ; R32 – < R32 P6 | NGINX ngx_http_ssl_module vulnerability | MEDIUM 6.3 | 0.7 % | ||
| CVE-2026-27651 | R36 – < R36 P3 ; R35 – < R35 P2 ; ≥ R34 ; … | NGINX ngx_mail_auth_http_module vulnerability | HIGH 8.7 | 1.0 % | ||
| CVE-2026-28755 | R36 – < R36 P3 ; R35 – < R35 P2 ; ≥ R34 ; … | NGINX ngx_stream_ssl_module vulnerability | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-28753 | R36 – < R36 P3 ; R35 – < R35 P2 ; ≥ R34 ; … | NGINX ngx_mail_proxy_module vulnerability | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-27654 | R36 – < R36 P3 ; R35 – < R35 P2 ; ≥ R34 ; … | NGINX ngx_http_dav_module vulnerability | HIGH 8.8 | 26 % | ||
| CVE-2026-32647 | R36 – < R36 P3 ; R35 – < R35 P2 ; ≥ R34 ; … | NGINX ngx_http_mp4_module vulnerability | HIGH 8.5 | 0.9 % | ||
| CVE-2026-1642 | R36 – < R36 P2 ; R35 – < R35 P1 ; ≥ R34 ; … | NGINX vulnerability | HIGH 8.2 | 0.4 % | ||
| CVE-2025-53859 | R34 – < R34 P2 ; R33 – < R33 P3 ; R32 – < R32 P3 ; … | NGINX ngx_mail_smtp_module vulnerability | MEDIUM 6.3 | 0.4 % | ||
| CVE-2025-23419 | ≥ R17 | TLS Session Resumption Vulnerability | MEDIUM 5.3 | 2.8 % | ||
| CVE-2024-7347 | ≥ R4 | NGINX MP4 module vulnerability | MEDIUM 5.7 | 0.3 % | ||
| CVE-2024-39792 | ≥ R30 | NGINX Plus MQTT vulnerability | HIGH 8.7 | 0.6 % | ||
| CVE-2024-35200 | R30 – < R32 | NGINX HTTP/3 QUIC vulnerability | MEDIUM 5.3 | 0.9 % | ||
| CVE-2024-34161 | R30 – < R32 | NGINX HTTP/3 QUIC vulnerability | MEDIUM 5.3 | 0.9 % | ||
| CVE-2024-32760 | R30 – < R32 | NGINX HTTP/3 QUIC vulnerability | MEDIUM 6.5 | 0.9 % | ||
| CVE-2024-31079 | R30 – < R32 | NGINX HTTP/3 QUIC vulnerability | MEDIUM 4.8 | 0.9 % | ||
| CVE-2024-24990 | R31 – < R31 P1 ; R30 – < R30 P2 | NGINX HTTP/3 QUIC vulnerability | HIGH 7.5 | 0.9 % | ||
| CVE-2024-24989 | R31 – < R31 P1 | NGINX HTTP/3 QUIC vulnerability | HIGH 7.5 | 1.1 % | ||
| CVE-2022-41743 | R27 – < R27-p1 ; R1 – < R26-p1 | NGINX ngx_http_hls_module vulnerability CVE-2022-41743 | HIGH 7.0 | 0.2 % | ||
| CVE-2022-41742 | R27 – < R27-p1 ; R1 – < R26-p1 | NGINX ngx_http_mp4_module vulnerability CVE-2022-41742 | HIGH 7.1 | 1.2 % | ||
| CVE-2022-41741 | R27 – < R27-p1 ; R1 – < R26-p1 | NGINX ngx_http_mp4_module vulnerability CVE-2022-41741 | HIGH 7.8 | 0.8 % |