Vulnerability (CVE)
Microsoft disclosed CVE-2026-42897, a spoofing bug stemming from a cross-site scripting flaw with a CVSS score of 8.1 affecting on-premise Exchange Server, which is under active exploitation in the wild. Microsoft is offering a temporary mitigation through...
Researchers at depthfirst disclosed CVE-2026-42945, a heap buffer overflow in NGINX's ngx_http_rewrite_module with a CVSS v4 score of 9.2 that went undetected for 18 years, affecting NGINX Plus and NGINX Open Source. F5 said the flaw is reachable by an...
A heap buffer overflow in NGINX's ngx_http_rewrite_module, tracked as CVE-2026-42945 with a CVSS score of 9.2, affects NGINX versions 0.6.27 through 1.30.0 and was introduced in 2008, according to depthfirst. VulnCheck reports active exploitation attempts...
F5 released security updates for two critical flaws in NGINX Open Source that could be exploited to achieve code execution, with patches available in updated versions and mitigations outlined by the company. CyStack's Trung Nguyen described CVE-2026-42530...