0xjacky Nginx-Ui
44 CVEs affecting 0xjacky Nginx-Ui. Latest disclosed: 2026-10-12. Critical: 6, High: 29.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42238 | Critical | 9.8 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is compl… |
CVE-2026-33032 | Critical | 9.8 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP… |
CVE-2026-27944 | Critical | 9.8 | 2026-03-05 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses… |
CVE-2024-49368 | Critical | 9.8 | 2024-10-21 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and… |
CVE-2024-23827 | Critical | 9.8 | 2024-01-29 | Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check i… |
CVE-2026-33026 | Critical | 9.1 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encryp… |
CVE-2026-84318 | High | 8.8 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk… |
CVE-2026-84317 | High | 8.8 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks… |
CVE-2026-84316 | High | 8.8 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the… |
CVE-2026-84313 | High | 8.8 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside Re… |
CVE-2026-107813 | High | 8.8 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cl… |
CVE-2026-107811 | High | 8.8 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose… |
CVE-2026-107809 | High | 8.8 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential aft… |
CVE-2026-107807 | High | 8.8 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret q… |
CVE-2026-33030 | High | 8.8 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerabil… |
CVE-2024-23828 | High | 8.8 | 2024-01-29 | Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the… |
CVE-2026-44015 | High | 8.5 | 2026-05-12 | Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creati… |
CVE-2026-84319 | High | 8.3 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_… |
CVE-2026-84315 | High | 8.3 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation rout… |
CVE-2026-84360 | High | 8.1 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /m… |