https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:39:45 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-250203 EUVD-2026-250203 https://cve.radiocsirt.org/vuln/euvd-2026-250203 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55740 <p>nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml contain default credentials (default_password: &#34;change_me_please&#34;, GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. The issue is addressed in v1.5.0 and later.</p> <p>nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml contain default credentials (default_password: &#34;change_me_please&#34;, GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. The issue is addressed in v1.5.0 and later.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-55740 https://cve.radiocsirt.org/vuln/ghsa-pr72-8fxw-xx22 <p><strong>Affected:</strong> Go: github.com/Anipaleja/nginx-defender</p> <p>### Impact This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files [config.yaml](https://github.com/Anipaleja/nginx-defender/blob/main/config.yaml), [docker-compose.yml](https://github.com/Anipaleja/nginx-defender/blob/main/docker-compose.yml) contain default credentials (`default_password: &#34;change_me_please&#34;`, `GF_SECURITY_ADMIN_PASSWORD=admin123`). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections.</p> <p>**Who is impacted?** All users who deploy nginx-defender with default credentials and expose the admin interface to untrusted networks.</p> <p>### Patches The issue is addressed in v1.5.0 and later.</p> <p>Startup warnings are added if default credentials are detected. Documentation now strongly recommends changing all default passwords before deployment. Patched versions: 1.5.0 and later **Will be fully patched in v1.7.0 and later**</p> <p>### Workarounds Users can remediate the vulnerability without upgrading by manually changing all default credentials in configuration files before deployment: ```yaml # config.yaml auth: default_password: &#34;your_strong_password_here&#34; ```</p> <p>```yml # docker-compose.yml - GF_SECURITY_ADMIN_PASSWORD=your_strong_password ``` Restrict access to the admin interface and use environment variables for secrets.</p> <p>### References - [Security Configuration Guide](https://github.com/Anipaleja/nginx-defender/blob/main/d…</p> <p><strong>Affected:</strong> Go: github.com/Anipaleja/nginx-defender</p> <p>### Impact This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files [config.yaml](https://github.com/Anipaleja/nginx-defender/blob/main/config.yaml), [docker-compose.yml](https://github.com/Anipaleja/nginx-defender/blob/main/docker-compose.yml) contain default credentials (`default_password: &#34;change_me_please&#34;`, `GF_SECURITY_ADMIN_PASSWORD=admin123`). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections.</p> <p>**Who is impacted?** All users who deploy nginx-defender with default credentials and expose the admin interface to untrusted networks.</p> <p>### Patches The issue is addressed in v1.5.0 and later.</p> <p>Startup warnings are added if default credentials are detected. Documentation now strongly recommends changing all default passwords before deployment. Patched versions: 1.5.0 and later **Will be fully patched in v1.7.0 and later**</p> <p>### Workarounds Users can remediate the vulnerability without upgrading by manually changing all default credentials in configuration files before deployment: ```yaml # config.yaml auth: default_password: &#34;your_strong_password_here&#34; ```</p> <p>```yml # docker-compose.yml - GF_SECURITY_ADMIN_PASSWORD=your_strong_password ``` Restrict access to the admin interface and use environment variables for secrets.</p> <p>### References - [Security Configuration Guide](https://github.com/Anipaleja/nginx-defender/blob/main/d…</p> https://cve.radiocsirt.org/vuln/ghsa-pr72-8fxw-xx22