Skip to content
Sign in

F5 product

NGINX Open Source

Alert
No NGINX Open Source CVE is in the CISA KEV catalogue.

Tracked since 18 Jun · latest article 30 Jul · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 0 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date

No NGINX Open Source CVE is in the CISA KEV catalogue.

Patch cadence and exploit odds

How often CISA adds NGINX Open Source CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

CISA has not added a NGINX Open Source CVE to KEV.

Fix listed

3 of 3 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-42055: 93.8th percentileCVE-2026-42530: 93.5th percentileCVE-2026-1642: 32th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-4205593.8
CVE-2026-4253093.5
CVE-2026-164232

Coverage5 articles · all time

The latest 5 articles naming NGINX Open Source, in the shared story grammar.

Full timeline
Quiet for 14 weekslast report 30 Jul5 articles4 outlets

5 articles from 4 outlets since 18 Jun. Quiet since 30 Jul.

Now18 Jun19202129 Jul311 NovFirst reportSecurityWeek · 18 Jun, 09:54Picked up againafter 6 weeks quiet
  • Thu 18 Jun, 09:54 UTC. SecurityWeek, first report. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-42055.
  • Thu 18 Jun, 15:11 UTC. Security Affairs, its first report on the story. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution.
  • Fri 19 Jun, 03:31 UTC. SecurityOnline, its first report on the story. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055).
  • Fri 19 Jun, 14:02 UTC. SOCRadar, its first report on the story. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws.
  • Thu 30 Jul, 15:07 UTC. SecurityOnline. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Thu 18 JunDay 02
    1. F5 patches NGINX remote code flaws CVE-2026-42530, CVE-2026-4205509:54 · SecurityWeek · First report
    2. F5 Patches Critical NGINX Vulnerabilities Enabling Unauthenticated Code Execution15:11 · Security Affairs
  2. Fri 19 JunDay 12
    1. F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)03:31 · SecurityOnline
    2. F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws14:02 · SOCRadar

  3. Quiet for 6 weeks

    Thu 30 JulDay 421
    1. CVE-2026-42530: NGINX HTTP/3 flaw allows remote code execution15:07 · SecurityOnline · Picked up again

All CVEs in coverage3

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-42055

    NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

    9.2Critical6.5% EPSS · 3 articles
  • CVE-2026-42530

    F5 NGINX Open Source vulnerability

    9.2Critical6.2% EPSS · 5 articles
  • CVE-2026-1642

    NGINX vulnerability

    Not scored0.4% EPSS · 0 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in