Login Request a demo
NG
Product
nginx-ui
by 0xJacky · last CVE Oct 12, 2026
36
CVEs
0
On KEV
9.9
Max CVSS
21
New 30D
Vulnerabilities36In the news1Timeline
Severity mix
Critical 8High 21Medium 7Low 0
Severity
All severities36Critical8High21Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add nginx-ui to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-44015
9.9
0%
May 12
Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services
Affected: <= 2.3.4
CVE-2026-33030
9.9
0%
Mar 30
Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys
Affected: <= 2.3.3
CVE-2026-42238
9.8
1%
May 4
Unauthenticated Remote Code Execution via Backup Restore in nginx-ui
Affected: < 2.3.8
CVE-2026-42222
9.8
0%
May 4
nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover
Affected: = 2.3.5
CVE-2026-42221
9.8
1%
May 4
nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim
Affected: >= 2.0.0, < 2.3.8
CVE-2026-33032
9.8
35%
Mar 30
Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
Affected: <= 2.3.5
CVE-2026-27944
9.8
23%
Mar 5
Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
Affected: < 2.3.3
CVE-2026-33026
9.1
0%
Mar 30
nginx-ui Backup Restore Allows Tampering with Encrypted Backups
Affected: < 2.3.4
Showing 8