Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: NginxProxyManager Clear all filters
TI-2026-65357 CVE-2026-102335 · GHSA-886j-w36h-wmx2

Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config

Priority LOW 31

Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00227 Published 2026-09-28 No fix listed CWE-863
TI-2026-65356 CVE-2026-102334 · GHSA-pm9h-p429-j8c5

Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Priority MEDIUM 42

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00453 Published 2026-09-28 No fix listed CWE-307
TI-2026-29266 CVE-2026-40519 · GHSA-4pgp-q8h4-9wxm

Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()

Priority LOW 37

Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function in backend/setup.js…

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00921 Published 2026-06-08 Fixed CWE-78