0xJacky · nginx-ui vulnerability disclosures
Explore 44 current published CVE records under this source identity, canonical score coverage, provider assessments and recent disclosures. Verify affected versions in the original source.
Current source coverage
- Published CVE records
- 44
- Canonical CVSS recorded
- 44
- No canonical CVSS score
- 0
- Listed in the retained CISA KEV catalog
- 0
- EPSS recorded
- 44
- NVD status recorded
- 44
Recent source disclosures
- CVE-2026-84312 — Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
- CVE-2026-84360 — Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
- CVE-2026-84316 — Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
- CVE-2026-84319 — Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
- CVE-2026-84317 — Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
- CVE-2026-84313 — Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
- CVE-2026-84321 — Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
- CVE-2026-84314 — Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
- CVE-2026-84320 — Nginx UI: Auto backup name allows path traversal outside validated storage path
- CVE-2026-84318 — Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Source revision: a62ec541fa6cb865d02001298e955dbed589f294
Counts describe distinct currently published, source-present CVE records, grouping only case variations of publisher-supplied names; they do not establish organizational exposure.
Canonical labels retain an actual source spelling. Synonyms and aliases are not merged; versions and vendor attribution require source review.
Provider coverage describes currently retained assessments; it does not reconstruct historical risk. Check source freshness separately.