Read the docs

NginxProxyManager

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

NginxProxyManager records in CISA KEV

No NginxProxyManager vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Nginx Proxy Manager 1 record HIGH

Records

5 records

TI-2026-65356 CVE-2026-102334 · GHSA-pm9h-p429-j8c5

Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Priority MEDIUM 42

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00453 Published 2026-09-28 No fix listed CWE-307
TI-2026-29266 CVE-2026-40519 · GHSA-4pgp-q8h4-9wxm

Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()

Priority LOW 37

Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function in backend/setup.js…

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00921 Published 2026-06-08 Fixed CWE-78
TI-2026-65357 CVE-2026-102335 · GHSA-886j-w36h-wmx2

Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config

Priority LOW 31

Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00227 Published 2026-09-28 No fix listed CWE-863
Open these records in search →