Nginxui Nginx Ui vulnerabilities

• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up CVE-2026-107813 Fix available 8.8 HighOctober 9, 2026
• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM CVE-2026-107812 Fix available 7.5 HighOctober 9, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser CVE-2026-107811 Fix available 8.8 HighOctober 9, 2026
• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied CVE-2026-107810 Fix available 8.1 HighOctober 9, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs CVE-2026-107809 Fix available 8.8 HighOctober 9, 2026
• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) CVE-2026-107808 Fix available 8.1 HighOctober 9, 2026
• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Node Secret Credential Exposure via URL Query Parameter CVE-2026-107807 Fix available 8.8 HighOctober 9, 2026
• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite CVE-2026-107806 Public exploitFix available 9.4 CriticalOctober 9, 2026
• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage CVE-2026-107805 Fix available 7.5 HighOctober 9, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more Unauthenticated Remote Code Execution via Backup Restore in nginx-ui CVE-2026-42238 Fix available 9.0 CriticalMay 4, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more nginx-ui: Settings API Exposes Protected Secrets CVE-2026-42223 Fix available 6.5 MediumMay 4, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover CVE-2026-42222 8.1 HighMay 4, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim CVE-2026-42221 Public exploitFix available 8.1 HighMay 4, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback CVE-2026-42220 6.5 MediumMay 4, 2026
• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services CVE-2026-44015 8.5 HighApril 29, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints CVE-2026-34403 Fix available 5.5 MediumApril 20, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more Nginx-UI: Disabled users retain full API access through previously issued bearer tokens CVE-2026-33031 Fix available 8.6 HighApril 20, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVE-2026-33032 Public exploit EPSS 35.3% 9.8 CriticalMarch 30, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys CVE-2026-33030 8.8 HighMarch 30, 2026
• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: DoS via Negative Integer Input in Logrotate Interval CVE-2026-33029 6.9 MediumMarch 30, 2026
• 0xjacky nginx-ui, nginxui nginx ui, uozi cosy +2 more Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse CVE-2026-33028 Fix available 7.1 HighMarch 30, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory CVE-2026-33027 6.9 MediumMarch 30, 2026
• 0xjacky nginx-ui, nginxui nginx ui +1 more nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVE-2026-33026 Fix available 9.4 CriticalMarch 30, 2026
• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure CVE-2026-27944 Public exploitFix available EPSS 22.8% 9.8 CriticalMarch 5, 2026
• nginxui nginx ui, 0xjacky nginx-ui +1 more Unchecked logrotate settings lead to arbitrary command execution CVE-2024-49368 Public exploit EPSS 27.7% 8.9 HighOctober 21, 2024
• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI's log path can be controlled CVE-2024-49367 5.5 MediumOctober 21, 2024
• nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI's json field can construct a directory traversal payload, causing arbitrary files to be written CVE-2024-49366 7.7 HighOctober 21, 2024
• cym1102 nginxwebui, nginxui nginx ui +1 more cym1102 nginxWebUI saveCmd handlePath certificate validation CVE-2024-3738 7.3 HighApril 13, 2024
• 0xjacky nginx-ui, nginxui nginx ui +1 more Nginx-UI authenticated RCE through injecting into the application config via CRLF CVE-2024-23828 Fix available 8.8 HighJanuary 29, 2024
• 0xjacky nginx-ui, nginxui nginx ui +1 more Nginx-UI arbitrary file write through the Import Certificate feature CVE-2024-23827 Fix available 9.8 CriticalJanuary 29, 2024
• 0xjacky nginx-ui, nginxui nginx ui +1 more Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268) CVE-2024-22198 Public exploitFix available 7.1 HighJanuary 11, 2024
• 0xjacky nginx-ui, nginxui nginx ui +1 more Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269) CVE-2024-22197 Fix available 7.7 HighJanuary 11, 2024
• 0xjacky nginx-ui, nginxui nginx ui +1 more Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270) CVE-2024-22196 Fix available 7.0 HighJanuary 11, 2024