Product by Open Source

    Nginx-ui

    21 known vulnerabilities in Nginx-ui (Open Source), 0 of them actively exploited (CISA KEV).

    Key figures

    21

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Nginx-ui (Open Source)
    HighCVE-2026-84318

    Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

    also in 2 other products

    		8.8
    CriticalCVE-2026-107806

    Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

    also in 3 other products

    		7.2
    HighCVE-2026-84313

    0xJacky Nginx-ui: Missing Authentication for Critical Function

    also in 2 other products

    		8.8
    HighCVE-2026-84316

    0xJacky Nginx-ui: Incomplete List of Disallowed Inputs

    also in 2 other products

    		8.8
    HighCVE-2026-84317

    0xJacky Nginx-ui: Improper Input Validation

    also in 2 other products

    		8.8
    HighCVE-2026-107811

    0xJacky Nginx-ui: Exposure of Sensitive Information to an Unauthorized Actor

    also in 3 other products

    		8.8
    HighCVE-2026-84314

    Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

    also in 2 other products

    		—
    HighCVE-2026-107810

    0xJacky Nginx-ui: Link Following

    also in 3 other products

    		8.1
    HighCVE-2026-84360

    Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

    also in 2 other products

    		8.1
    HighCVE-2026-107805

    Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

    also in 3 other products

    		7.5
    HighCVE-2026-107808

    0xJacky Nginx-ui: Authentication Bypass by Primary Weakness

    also in 3 other products

    		8.1
    HighCVE-2026-107813

    0xJacky Nginx-ui: Missing Authorization

    also in 3 other products

    		8.8
    HighCVE-2026-107807

    Nginx UI: Node Secret Credential Exposure via URL Query Parameter

    also in 3 other products

    		8.8
    HighCVE-2026-84315

    Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

    also in 2 other products

    		8.3
    HighCVE-2026-107809

    Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

    also in 3 other products

    		8.8
    HighCVE-2026-84319

    0xJacky Nginx-ui: Protection Mechanism Failure

    also in 2 other products

    		8.3
    HighCVE-2026-107812

    0xJacky Nginx-ui: Download of Code Without Integrity Check

    also in 3 other products

    		7.5
    HighCVE-2026-84312

    Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

    also in 2 other products

    		7.1
    MediumCVE-2026-84320

    Nginx UI: Auto backup name allows path traversal outside validated storage path

    also in 2 other products

    		6.3
    MediumCVE-2026-84321

    0xJacky Nginx-ui: Insufficient Session Expiration

    also in 2 other products

    		5.4
    MediumCVE-2026-107804

    Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

    also in 2 other products

    		5.3

    All products by Open Source