CVE WATCH / VULNERABILITY DETAIL
CVE-2026-15176
HIGHCVSS 8.1NVD feed
Published 14 October 2026 · tracked since 15 October 2026
Description
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-96615 MEDIUM 6.5
- CVE-2026-97205 HIGH 8.1
- CVE-2026-97629 MEDIUM 6.5
- CVE-2026-95101 MEDIUM 5.3
- CVE-2026-91184 HIGH 8.8
- CVE-2026-93479 HIGH 8.1
- CVE-2026-94197 HIGH 7.5
- CVE-2026-73800
- CVE-2026-73802
- CVE-2026-60021