Product by Nginxui
Nginx UI
32 known vulnerabilities in Nginx UI (Nginxui), 0 of them actively exploited (CISA KEV).
Key figures
32
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
11
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-33032 | Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover | 9.8 | |
| Critical | CVE-2026-27944 | Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure | 9.8 | |
| Critical | CVE-2024-49368 | Unchecked logrotate settings lead to arbitrary command execution | 9.8 | |
| Critical | CVE-2026-42221 | nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim | 9.8 | |
| High | CVE-2024-22198 | 0xJacky Nginx-ui: Command Injection | 7.1 | |
| Critical | CVE-2026-42238 | Unauthenticated Remote Code Execution via Backup Restore in nginx-ui | 9.8 | |
| Critical | CVE-2026-107806 | Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite | 7.2 | |
| High | CVE-2024-22197 | Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269) | 7.7 | |
| High | CVE-2026-107811 | 0xJacky Nginx-ui: Exposure of Sensitive Information to an Unauthorized Actor | 8.8 | |
| High | CVE-2026-107810 | 0xJacky Nginx-ui: Link Following | 8.1 | |
| High | CVE-2024-23828 | Nginx-UI authenticated RCE through injecting into the application config via CRLF | 8.8 | |
| Medium | CVE-2026-33029 | Nginx UI: DoS via Negative Integer Input in Logrotate Interval | 6.5 | |
| High | CVE-2026-107805 | Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage | 7.5 | |
| High | CVE-2026-107808 | 0xJacky Nginx-ui: Authentication Bypass by Primary Weakness | 8.1 | |
| High | CVE-2026-107813 | 0xJacky Nginx-ui: Missing Authorization | 8.8 | |
| High | CVE-2026-107807 | Nginx UI: Node Secret Credential Exposure via URL Query Parameter | 8.8 | |
| Critical | CVE-2024-23827 | Nginx-UI arbitrary file write through the Import Certificate feature | 9.8 | |
| High | CVE-2026-107809 | Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs | 8.8 | |
| Critical | CVE-2026-42222 | 0xJacky Nginx-ui: Missing Authentication for Critical Function | 9.8 | |
| Critical | CVE-2026-44015 | 0xJacky Nginx-ui: Server-Side Request Forgery (SSRF) | 9.9 | |
| High | CVE-2026-33028 | Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse | 7.5 | |
| Critical | CVE-2026-33026 | nginx-ui Backup Restore Allows Tampering with Encrypted Backups | 9.1 | |
| High | CVE-2026-107812 | 0xJacky Nginx-ui: Download of Code Without Integrity Check | 7.5 | |
| High | CVE-2024-49367 | Nginx UI's log path can be controlled | 7.5 | |
| High | CVE-2024-49366 | 0xJacky Nginx-ui: Path Traversal | 7.5 |