CISA Malcolm, a network traffic analysis tool, has several vulnerabilities that could allow attackers to execute arbitrary code or cause denial-of-service conditions. Versions prior to 26.07.0 are particularly affected by issues related to file extraction and role-based access control, allowing unauthorized access to sensitive areas and the potential execution of malicious code. Specifically, CVEs 2026-55676, 2026-63133, 2026-63134, 2026-63177, and 2026-19670 highlight problems with file upload handling and directory traversal protections. Users of Malcolm are urged to update to the latest versions—26.07.0 or 26.06.1—to mitigate these risks. These vulnerabilities are significant as they could compromise the integrity and availability of systems utilizing CISA Malcolm worldwide.
Articles tagged "Nginx"
Found 18 articles
Security Affairs
F5 has patched a serious vulnerability in NGINX, identified as CVE-2026-42533, which has a CVSS score of 9.2, indicating it is highly critical. This flaw allows unauthenticated attackers to exploit a heap buffer overflow by sending specially crafted HTTP requests, potentially leading to server crashes or remote code execution. This vulnerability affects NGINX servers widely used for hosting websites and applications, making it a significant concern for organizations relying on this technology. F5's quick response to release patches is crucial to mitigate the risks associated with this vulnerability, as it could lead to severe disruptions or data breaches if left unaddressed.
The Hacker News
F5 has released important updates to address a critical vulnerability in NGINX, identified as CVE-2026-42533. This flaw allows attackers to send specially crafted HTTP requests that can cause a heap buffer overflow in the NGINX worker process. As a result, this vulnerability could lead to the crashing or restarting of the worker, effectively denying service to legitimate users. The issue affects versions of NGINX prior to 1.30.4 and 1.31.3, as well as NGINX Plus versions before 37.0.3.1. Users running these versions should upgrade immediately to protect their systems from potential exploitation.
F5 has issued patches for several vulnerabilities found in its NGINX and BIG-IP products. These vulnerabilities could allow attackers to manipulate configurations, restart or terminate processes, cross security boundaries, leak sensitive memory information, and execute arbitrary code. Organizations using these products are at risk if they do not apply the updates promptly. The potential impact on system integrity and security is significant, making it crucial for affected users to act quickly to protect their environments. Keeping software up to date is essential in mitigating these risks and ensuring ongoing security.
Hitachi Energy has identified a buffer overflow vulnerability in specific versions of its e-mesh EMS product, which could lead to application outages and potential arbitrary code execution. The affected versions include e-mesh EMS 4.1.6, 4.4.2, and 4.7.0, which utilize NGINX versions 1.30.0 and below. Attackers could exploit this vulnerability by sending specially crafted HTTP requests under certain conditions, particularly if the system's Address Space Layout Randomization (ASLR) is disabled. Users are advised to apply a hotfix to update NGINX to version 1.30.2 or later and ensure ASLR is active. This vulnerability poses a significant risk to critical infrastructure sectors like energy, as it could lead to denial of service and operational disruptions.
Security Affairs
F5 has issued urgent patches for two critical vulnerabilities in NGINX, identified as CVE-2026-42530 and CVE-2026-42055, both rated with a CVSS score of 9.2. These flaws affect the HTTP modules and can be exploited remotely without any authentication, allowing attackers to execute arbitrary code and potentially corrupt memory. This presents a significant risk for organizations using affected NGINX versions, as it could lead to unauthorized access and system compromise. F5's out-of-band updates are crucial for users to secure their systems and prevent potential exploitation. Users are strongly advised to apply these patches promptly to mitigate the risks associated with these vulnerabilities.
F5 has issued patches for serious vulnerabilities found in NGINX, which could be exploited by remote attackers without needing authentication. These flaws could allow attackers to restart the server and potentially execute arbitrary code, raising significant security concerns for organizations using this software. Given that NGINX is widely utilized for web serving and proxying, the risks are substantial for many companies. Users and administrators are strongly advised to apply the patches as soon as possible to safeguard their systems from potential exploitation. This incident serves as a reminder of the importance of keeping software up to date and vigilant against emerging vulnerabilities.
Help Net Security
Last week, the hacking group TeamPCP claimed to have breached GitHub's internal codebase by using a poisoned Visual Studio Code (VS Code) extension. GitHub, owned by Microsoft, confirmed the breach and has since launched an investigation into how their private code repositories were compromised. This incident raises serious concerns about the security of development tools widely used by programmers. Moreover, researchers recently discovered a critical flaw in NGINX, a popular web server software, which is being actively exploited. These incidents highlight the ongoing vulnerabilities in essential software and the need for robust security measures to protect sensitive information.
A serious vulnerability has been discovered in F5 NGINX, a widely used web server technology that powers about one-third of all websites globally. This vulnerability is currently being exploited by attackers, raising alarms among cybersecurity experts. The issue poses a significant risk to countless websites and web applications that rely on NGINX for handling web traffic. Organizations using NGINX should take immediate action to assess their systems and implement necessary security measures to protect against potential attacks. The urgency of this situation is underscored by the fact that the vulnerability is actively being targeted in the wild, making prompt remediation essential to prevent data breaches and other malicious activities.
Help Net Security
A serious vulnerability in NGINX, identified as CVE-2026-42945 and nicknamed NGINX Rift, is currently being exploited by attackers. Disclosed last week, this flaw allows attackers to send specially crafted HTTP requests to vulnerable NGINX servers, potentially leading to denial-of-service conditions and even unauthenticated remote code execution. NGINX is the most widely used web server, meaning a large number of websites and applications could be at risk. Security researcher Patrick Garrity highlighted the urgency of addressing this vulnerability as it poses significant risks to web services that rely on NGINX. It's crucial for administrators to take immediate action to protect their systems from these exploits.
The Hacker News
A serious vulnerability in NGINX, tracked as CVE-2026-42945, is currently being exploited in the wild, just days after it was disclosed. This flaw is a heap buffer overflow in the ngx_http_rewrite_module, which affects NGINX Plus and NGINX Open versions from 0.6.27 to 1.30.0. The CVSS score of 9.2 indicates a high severity, as it could lead to worker crashes and potentially allow remote code execution (RCE). Organizations using affected versions should prioritize patching their systems to prevent exploitation. Given the active nature of this threat, immediate action is crucial for maintaining security.
BleepingComputer
Researchers have discovered an 18-year-old vulnerability in the NGINX open-source web server that could allow attackers to launch denial of service (DoS) attacks and, under certain conditions, execute remote code. The flaw was identified using an automated scanning system, raising concerns for users of NGINX, which is widely used for serving web content. Organizations that rely on NGINX should be particularly vigilant, as this vulnerability poses a risk to the stability and security of their web services. Immediate attention to this issue is crucial to prevent exploitation, especially since the vulnerability has been around for nearly two decades. The long lifespan of such a flaw emphasizes the need for regular security audits and updates in software systems.
Researchers have identified multiple vulnerabilities in NGINX Plus and NGINX Open, including a severe flaw that has existed for 18 years. The most critical issue, a heap buffer overflow in the ngx_http_rewrite_module (CVE-2026-42945), could allow attackers to execute arbitrary code remotely without authentication. This vulnerability has a high severity score of 9.2 on the CVSS v4 scale. Organizations using these web servers are at risk, as the flaw could lead to significant security breaches. It is crucial for affected users to address this vulnerability promptly to safeguard their systems.
A serious vulnerability has been discovered in nginx-ui, which could allow attackers to manipulate NGINX configuration files. This flaw has a near-maximum severity rating, meaning it poses a significant risk to users of the software. Attackers can exploit this weakness to restart, create, modify, or delete configuration files, potentially disrupting web services and compromising server security. This vulnerability affects anyone using nginx-ui, making it crucial for system administrators to take action. The situation is urgent as it could lead to unauthorized access and control over server configurations.
Security Affairs
A severe vulnerability in nginx-ui, identified as CVE-2026-33032, is currently being exploited by attackers. This flaw allows unauthorized users to bypass authentication and gain complete control of Nginx servers, posing a significant risk to organizations using this web server technology. The vulnerability is linked to inadequate protection of the /mcp_message endpoint, which can be exploited without any prior authentication. With a CVSS score of 9.8, it is crucial for users to take immediate action to secure their systems. Organizations should prioritize patching their Nginx installations to mitigate this serious threat.