0xJacky

Records44All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high25CVSS 7.0–8.9

Exploited now

0xJacky records in CISA KEV

No 0xJacky vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Nginx Ui 32 records HIGH

Records

44 records

TI-2026-25478 CVE-2026-33032 · GHSA-h6c2-x2m2-mwhf

Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

HIGH 82

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.35273 Published 2026-03-30 No fix listed CWE-306

TI-2026-25472 CVE-2026-33026 · GHSA-fhh2-gg7w-gwpq

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

HIGH 82

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00334 Published 2026-03-30 Fixed in 2.3.4, 1.9.10-0.20260315015203-f61bcec547c0 CWE-312

TI-2026-22288 CVE-2026-27944 · GHSA-g9w5-qffc-6762

Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

HIGH 82

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.22842 Published 2026-03-05 Fixed in 2.3.3 CWE-306

TI-2024-15821 CVE-2024-23827 · GHSA-xvq9-4vpv-227m

Nginx-UI arbitrary file write through the Import Certificate feature

HIGH 82

Nginx-UI is a web interface to manage Nginx configurations.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00705 Published 2024-01-29 Fixed in 2.0.0.beta.12, 1.9.10-0.20240128060047-8581bdd3c6f4 CWE-22

TI-2026-70057 CVE-2026-107806 · GHSA-p393-cf76-4jmr

Code injection in Nginx UI backup restore allows code execution

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00571 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074146-a467ed652591 CWE-94

TI-2026-32056 CVE-2026-44015 · GHSA-wr32-99hh-6f35

Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00318 Published 2026-05-12 No fix listed CWE-918

TI-2026-30543 CVE-2026-42222 · GHSA-mxqh-q9h6-v8pq

nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00339 Published 2026-05-04 No fix listed CWE-284

TI-2026-30542 CVE-2026-42221 · GHSA-h27v-ph7w-m9fp

nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01342 Published 2026-05-04 Fixed in 2.3.8 CWE-306

TI-2026-25476 CVE-2026-33030 · GHSA-5hf2-vhj6-gj9m

Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00285 Published 2026-03-30 No fix listed CWE-639

TI-2026-30559 CVE-2026-42238 · GHSA-4pvg-prr3-9cxr

Unauthenticated Remote Code Execution via Backup Restore in nginx-ui

HIGH 74

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0CRITICAL 9.0 Network No auth User interaction EPSS 0.00971 Published 2026-05-04 Fixed in 2.3.8 CWE-94

TI-2026-71318 CVE-2026-84318 · GHSA-9jww-cxg5-rj9m

Nginx UI MCP tool skips config validation, allowing authenticated RCE

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00816 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-693

TI-2026-71317 CVE-2026-84317 · GHSA-76pm-mq2q-9gcr

Nginx UI MCP tool allows nginx directive injection

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00478 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-20

TI-2026-71316 CVE-2026-84316 · GHSA-cf23-7qxj-xmhr

Nginx UI config validation bypass allows directive injection

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00507 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-184

TI-2026-71314 CVE-2026-84314 · GHSA-2gc7-j998-5xx6

Account takeover in Nginx UI via missing secure session check

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00419 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-285

TI-2026-71313 CVE-2026-84313 · GHSA-gfrc-g87h-7h5w

Missing re-authentication in Nginx UI TOTP and passkey enrollment

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00542 Published 2026-10-12 Fixed in 2.4.1, 1.9.10-0.20260703131214-23d1934099b0 CWE-287

TI-2026-70044 CVE-2026-107807 · GHSA-pvgv-gcp7-v38g

Nginx UI exposes node secret in URL query parameter

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00296 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074433-a3999bd78a3b CWE-312

TI-2026-70036 CVE-2026-107811 · GHSA-32gc-wf3m-78w9

Node token exposure in Nginx UI enables cross-node impersonation

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00435 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728091109-0ecbd106c37b CWE-200

TI-2024-32954 CVE-2024-49366

Nginx UI's json field can construct a directory traversal payload, causing arbitrary files to be written

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00595 Published 2024-10-21 Fixed in 2.0.0-beta.36 CWE-22

TI-2024-14791 CVE-2024-22198 · GHSA-8r25-68wm-jw35

Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

HIGH 73

Nginx-UI is a web interface to manage Nginx configurations.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04055 Published 2024-01-11 Fixed in 2.0.0.beta.9, 1.9.10-0.20231219184941-827e76c46e63 CWE-77

TI-2024-14790 CVE-2024-22197 · GHSA-pxmr-q2x3-9x9m

Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

HIGH 73

Nginx-ui is online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01537 Published 2024-01-11 Fixed in 2.0.0.beta.9, 1.9.10-0.20231219184941-827e76c46e63 CWE-77

TI-2026-25477 CVE-2026-33031 · GHSA-x234-x5vq-cc2v