Product by 0xjacky

    Nginx-ui

    44 known vulnerabilities in Nginx-ui (0xjacky), 0 of them actively exploited (CISA KEV).

    Key figures

    44

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    11

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Nginx-ui (0xjacky)
    CriticalCVE-2026-33032

    Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

    also in 2 other products

    		9.8
    CriticalCVE-2026-27944

    Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

    also in 2 other products

    		9.8
    CriticalCVE-2024-49368

    Unchecked logrotate settings lead to arbitrary command execution

    also in 1 other product

    		9.8
    CriticalCVE-2026-42221

    nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

    also in 2 other products

    		9.8
    HighCVE-2024-22198

    0xJacky Nginx-ui: Command Injection

    also in 2 other products

    		7.1
    HighCVE-2026-84318

    Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

    also in 2 other products

    		8.8
    CriticalCVE-2026-42238

    Unauthenticated Remote Code Execution via Backup Restore in nginx-ui

    also in 2 other products

    		9.8
    CriticalCVE-2026-107806

    Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

    also in 3 other products

    		7.2
    HighCVE-2026-84313

    0xJacky Nginx-ui: Missing Authentication for Critical Function

    also in 2 other products

    		8.8
    HighCVE-2026-84316

    0xJacky Nginx-ui: Incomplete List of Disallowed Inputs

    also in 2 other products

    		8.8
    HighCVE-2026-84317

    0xJacky Nginx-ui: Improper Input Validation

    also in 2 other products

    		8.8
    HighCVE-2024-22197

    Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

    also in 2 other products

    		7.7
    HighCVE-2026-107811

    0xJacky Nginx-ui: Exposure of Sensitive Information to an Unauthorized Actor

    also in 3 other products

    		8.8
    HighCVE-2026-84314

    Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

    also in 2 other products

    		—
    HighCVE-2026-107810

    0xJacky Nginx-ui: Link Following

    also in 3 other products

    		8.1
    HighCVE-2024-23828

    Nginx-UI authenticated RCE through injecting into the application config via CRLF

    also in 2 other products

    		8.8
    MediumCVE-2026-33029

    Nginx UI: DoS via Negative Integer Input in Logrotate Interval

    also in 2 other products

    		6.5
    HighCVE-2026-84360

    Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

    also in 2 other products

    		8.1
    HighCVE-2026-107805

    Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

    also in 3 other products

    		7.5
    HighCVE-2026-107808

    0xJacky Nginx-ui: Authentication Bypass by Primary Weakness

    also in 3 other products

    		8.1
    HighCVE-2026-107813

    0xJacky Nginx-ui: Missing Authorization

    also in 3 other products

    		8.8
    HighCVE-2026-107807

    Nginx UI: Node Secret Credential Exposure via URL Query Parameter

    also in 3 other products

    		8.8
    HighCVE-2026-84315

    Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

    also in 2 other products

    		8.3
    CriticalCVE-2024-23827

    Nginx-UI arbitrary file write through the Import Certificate feature

    also in 2 other products

    		9.8
    HighCVE-2026-107809

    Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

    also in 3 other products

    		8.8

    All vulnerabilities in search

    News

    All products by 0xjacky