0xJacky

Records44All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high25CVSS 7.0–8.9

Exploited now

0xJacky records in CISA KEV

No 0xJacky vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Nginx Ui 32 records HIGH

Records

32 records in Nginx Ui · all components

TI-2026-25478 CVE-2026-33032 · GHSA-h6c2-x2m2-mwhf

Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

HIGH 82

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.35273 Published 2026-03-30 No fix listed CWE-306

TI-2026-25472 CVE-2026-33026 · GHSA-fhh2-gg7w-gwpq

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

HIGH 82

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00334 Published 2026-03-30 Fixed in 2.3.4, 1.9.10-0.20260315015203-f61bcec547c0 CWE-312

TI-2026-22288 CVE-2026-27944 · GHSA-g9w5-qffc-6762

Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

HIGH 82

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.22842 Published 2026-03-05 Fixed in 2.3.3 CWE-306

TI-2024-15821 CVE-2024-23827 · GHSA-xvq9-4vpv-227m

Nginx-UI arbitrary file write through the Import Certificate feature

HIGH 82

Nginx-UI is a web interface to manage Nginx configurations.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00705 Published 2024-01-29 Fixed in 2.0.0.beta.12, 1.9.10-0.20240128060047-8581bdd3c6f4 CWE-22

TI-2026-70057 CVE-2026-107806 · GHSA-p393-cf76-4jmr

Code injection in Nginx UI backup restore allows code execution

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00571 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074146-a467ed652591 CWE-94

TI-2026-32056 CVE-2026-44015 · GHSA-wr32-99hh-6f35

Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00318 Published 2026-05-12 No fix listed CWE-918

TI-2026-30543 CVE-2026-42222 · GHSA-mxqh-q9h6-v8pq

nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00339 Published 2026-05-04 No fix listed CWE-284

TI-2026-30542 CVE-2026-42221 · GHSA-h27v-ph7w-m9fp

nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01342 Published 2026-05-04 Fixed in 2.3.8 CWE-306

TI-2026-25476 CVE-2026-33030 · GHSA-5hf2-vhj6-gj9m

Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys

HIGH 76

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00285 Published 2026-03-30 No fix listed CWE-639

TI-2026-30559 CVE-2026-42238 · GHSA-4pvg-prr3-9cxr

Unauthenticated Remote Code Execution via Backup Restore in nginx-ui

HIGH 74

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0CRITICAL 9.0 Network No auth User interaction EPSS 0.00971 Published 2026-05-04 Fixed in 2.3.8 CWE-94

TI-2026-70044 CVE-2026-107807 · GHSA-pvgv-gcp7-v38g

Nginx UI exposes node secret in URL query parameter

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00296 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074433-a3999bd78a3b CWE-312

TI-2026-70036 CVE-2026-107811 · GHSA-32gc-wf3m-78w9

Node token exposure in Nginx UI enables cross-node impersonation

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00435 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728091109-0ecbd106c37b CWE-200

TI-2024-32954 CVE-2024-49366

Nginx UI's json field can construct a directory traversal payload, causing arbitrary files to be written

HIGH 73

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00595 Published 2024-10-21 Fixed in 2.0.0-beta.36 CWE-22

TI-2024-14791 CVE-2024-22198 · GHSA-8r25-68wm-jw35

Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

HIGH 73

Nginx-UI is a web interface to manage Nginx configurations.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04055 Published 2024-01-11 Fixed in 2.0.0.beta.9, 1.9.10-0.20231219184941-827e76c46e63 CWE-77

TI-2024-14790 CVE-2024-22197 · GHSA-pxmr-q2x3-9x9m

Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

HIGH 73

Nginx-ui is online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01537 Published 2024-01-11 Fixed in 2.0.0.beta.9, 1.9.10-0.20231219184941-827e76c46e63 CWE-77

TI-2026-25477 CVE-2026-33031 · GHSA-x234-x5vq-cc2v

Nginx-UI: Disabled users retain full API access through previously issued bearer tokens

HIGH 72

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-20 Fixed in 2.3.4, 1.9.10-0.20260314152518-7b66578adb47 CWE-284

TI-2026-70038 CVE-2026-107808 · GHSA-45gv-9wjv-xh7p

Authentication bypass in Nginx UI lets password login skip passkey 2FA

HIGH 70

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00413 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074558-95cd21b70814 CWE-287

TI-2026-25473 CVE-2026-33027 · GHSA-m8p8-53vf-8357

Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory

HIGH 70

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00413 Published 2026-03-30 Fixed in 2.3.4 CWE-22

TI-2024-32956 CVE-2024-49368

Unchecked logrotate settings lead to arbitrary command execution

HIGH 69

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.27668 Published 2024-10-21 Fixed in 2.0.0-beta.36 CWE-20

TI-2026-70043 CVE-2026-107810 · GHSA-p8v3-89rh-jxc7

Nginx UI backup restore follows symlinks into live Nginx config

HIGH 68

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00445 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728074146-a467ed652591 CWE-59

TI-2026-70039 CVE-2026-107812 · GHSA-662p-52hx-cmh2

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest →…

HIGH 68

Nginx UI is a web user interface for the Nginx web server.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00175 Published 2026-10-09 Fixed in 2.5.0, 1.9.10-0.20260728114330-580585516dd8 CWE-494

TI-2026-25475 CVE-2026-33029 · GHSA-cp8r-8jvw-v3qg

Nginx UI: DoS via Negative Integer Input in Logrotate Interval

MEDIUM 64

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00985 Published 2026-03-30 Fixed in 2.3.4 CWE-20

TI-2026-25474 CVE-2026-33028 · GHSA-m468-xcm6-fxg4

Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse

MEDIUM 64

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0HIGH 7.1 Network High privileges No interaction EPSS 0.00554 Published 2026-03-30 Fixed in 2.3.4, 1.30.1 CWE-362

TI-2024-32955 CVE-2024-49367

Nginx UI's log path can be controlled

MEDIUM 64

Nginx UI is a web user interface for the Nginx web server.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00639 Published 2024-10-21 Fixed in 2.0.0-beta.36 CWE-862

TI-2024-14789 CVE-2024-22196 · GHSA-h374-mm57-879c

Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

MEDIUM 64

Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time.

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00584 Published 2024-01-11 Fixed in 2.0.0.beta.9, 1.9.10-0.20231219195202-ec93ab05a3ec CWE-89

Open these records in search →