early signals oss-security infra

nginx RCEs CVE-2026-93479, CVE-2026-15176

// AI summary

Security advisories identify two nginx remote code execution vulnerabilities, CVE-2026-93479 and CVE-2026-15176, affecting open-source versions before 1.31.7 or 1.30.6.

// from the source

Posted by Jan Schaumann on Oct 23 F5 has published a security advisory: https://my.f5.com/manage/s/article/K000163408 This includes issues in the Open Source nginx: https://nginx.org/en/security_advisories.html That page makes it hard to identify which issues were published when, though, and I don t believe the team posts them here. The following appear to impact open source nginx prior to 1.31.7 or 1.30.6. At least two of them include a possibility of RCE....
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

    seclists.org
  2. oss-security

    CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

    seclists.org
  3. oss-security infra

    [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)

    seclists.org
  4. oss-security infra

    [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

    seclists.org
  5. oss-security infra

    CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

    seclists.org