github.com/0xjacky/nginx-ui vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-84360Highgithub.com/0xJacky/Nginx-UI: Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration toolsCVE-2026-84321Mediumgithub.com/0xJacky/Nginx-UI: Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enableCVE-2026-84316Highgithub.com/0xJacky/Nginx-UI: Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive…CVE-2026-84312Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)CVE-2026-84315Highgithub.com/0xJacky/Nginx-UI: Nginx UI OTP secure-session step-up is missing on sensitive mutation routesCVE-2026-84314Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management EndpointCVE-2026-84313Highgithub.com/0xJacky/Nginx-UI: Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeoverCVE-2026-84318Highgithub.com/0xJacky/Nginx-UI: Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCECVE-2026-84317Highgithub.com/0xJacky/Nginx-UI: Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)CVE-2026-84320Mediumgithub.com/0xJacky/Nginx-UI: Nginx UI: Auto backup name allows path traversal outside validated storage pathCVE-2026-84319Highgithub.com/0xJacky/Nginx-UI: Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx…CVE-2026-107805Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storageCVE-2026-107804Mediumgithub.com/0xJacky/Nginx-UI: Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockoutCVE-2026-107806Criticalgithub.com/0xJacky/Nginx-UI: Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config OverwriteCVE-2026-107812Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITMCVE-2026-107808Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)CVE-2026-107809Highgithub.com/0xJacky/Nginx-UI: Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIsCVE-2026-107813Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive…CVE-2026-107811Highgithub.com/0xJacky/Nginx-UI: 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUserCVE-2026-107807Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Node Secret Credential Exposure via URL Query ParameterCVE-2026-107810Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are appliedCVE-2026-42238Criticalgithub.com/0xJacky/nginx-ui: Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup RestoreCVE-2026-42223Mediumgithub.com/0xJacky/nginx-ui: Nginx-UI Settings API Exposes Protected SecretsCVE-2026-42222Highgithub.com/0xJacky/nginx-ui: Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeoverCVE-2026-42221Highgithub.com/0xJacky/Nginx-UI: Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo