Login Request a demo
NG
Product
nginx-ui
by 0xJacky · last CVE Oct 12, 2026
36
CVEs
0
On KEV
9.9
Max CVSS
21
New 30D
Vulnerabilities36In the news1Timeline
Severity mix
Critical 8High 21Medium 7Low 0
Severity
All severities36Critical8High21Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add nginx-ui to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-42223
6.5
0%
May 4
nginx-ui: Settings API Exposes Protected Secrets
Affected: < 2.3.8
CVE-2026-42220
6.5
0%
May 4
nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback
Affected: < 2.3.8
CVE-2026-33027
6.5
0%
Mar 30
Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory
Affected: < 2.3.4
CVE-2026-33029
6.5
1%
Mar 30
Nginx UI: DoS via Negative Integer Input in Logrotate Interval
Affected: < 2.3.4
CVE-2026-84320
6.3
0%
Oct 12
Nginx UI: Auto backup name allows path traversal outside validated storage path
Affected: < 2.4.3
CVE-2026-84321
5.4
0%
Oct 12
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Affected: < 2.4.1
CVE-2026-107804
5.3
0%
Oct 9
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
Affected: >= 2.2.0, < 2.6.0
Showing 7