Nginx Instance Manager
Vendor:
First CVE: Aug 4, 2022 · Active for 3 years
16
Total CVEs
More Total CVEs than 92% of tracked products
4.0
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
6.4
Avg CVSS
Higher Avg CVSS than 27% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Nginx Instance Manager over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 4, 2022
3 years ago
Most Recent CVE
Jun 17, 2026
37 days ago
CVE Severity & Scoring
Nginx Instance Manager16 CVEs
63%
38%
All CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local2 (12.5%)
Network14 (87.5%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low8 (50.0%)
High8 (50.0%)
Unknown0 (0.0%)
User Interaction
None15 (93.8%)
Unknown0 (0.0%)
Required1 (6.3%)
Privileges Required
Low4 (25.0%)
High1 (6.3%)
None11 (68.8%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-42945HIGH NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or s | May 13, 2026 | 8.1 | 79 | NO | NO |
CVE-2026-42530HIGH NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along | Jun 17, 2026 | 8.1 | 44 | NO | NO |
CVE-2026-42055HIGH NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 o | Jun 17, 2026 | 8.1 | 43 | NO | NO |
CVE-2026-42946HIGH A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi | May 13, 2026 | 7.4 | 31 | NO | NO |
CVE-2026-40460MEDIUM When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or | May 13, 2026 | 6.5 | 30 | NO | NO |
CVE-2026-40701MEDIUM NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directiv | May 13, 2026 | 4.8 | 28 | NO | NO |
CVE-2026-42926MEDIUM When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and p | May 13, 2026 | 5.8 | 26 | NO | NO |
CVE-2026-1642MEDIUM A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position | Feb 4, 2026 | 5.9 | 26 | NO | NO |
CVE-2026-48142MEDIUM NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf | Jun 17, 2026 | 4.8 | 25 | NO | NO |
CVE-2026-42934MEDIUM NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (" | May 13, 2026 | 4.8 | 24 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (16 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (16 CVEs).
Media Mentions
Signals from CVEs in this product scope (16 CVEs).
Top CNAs Publishing CVEs For Nginx Instance Manager
Top CWEs
Versions
No cataloged versions.