Nginxproxymanager

5 CVEs in 2 Nginxproxymanager products, including Nginx-Proxy-Manager, nginx Proxy Manager. Newest: CVE-2026-102335 (2026-09-28).

Nginxproxymanager products with known CVEs

ProductCVEs
Nginx-Proxy-Manager4
nginx Proxy Manager1
Nginxproxymanager CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-102335High7.12026-09-28Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject ar…
CVE-2026-102334High7.42026-09-28Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses again…
CVE-2026-93964Medium5.32026-09-20A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/…
CVE-2026-40519High7.52026-06-08Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command inject…
CVE-2022-28379Medium6.82022-04-03jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.