0xJacky vulnerability disclosures
Explore 44 current published CVE records under this source identity, canonical score coverage, provider assessments and recent disclosures. Verify affected versions in the original source.
Current source coverage
- Published CVE records
- 44
- Canonical CVSS recorded
- 44
- No canonical CVSS score
- 0
- Listed in the retained CISA KEV catalog
- 0
- EPSS recorded
- 44
- NVD status recorded
- 44
Recent source disclosures
- CVE-2026-84312 — Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
- CVE-2026-84360 — Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
- CVE-2026-84316 — Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
- CVE-2026-84319 — Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
- CVE-2026-84317 — Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
- CVE-2026-84313 — Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
- CVE-2026-84321 — Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
- CVE-2026-84314 — Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
- CVE-2026-84320 — Nginx UI: Auto backup name allows path traversal outside validated storage path
- CVE-2026-84318 — Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Source products
- nginx-ui — 44 CVEs
Source revision: a57c5fef8999dd727850df0964bbdbc83b9ab7b3
Counts describe distinct currently published, source-present CVE records, grouping only case variations of publisher-supplied names; they do not establish organizational exposure.
Canonical labels retain an actual source spelling. Synonyms and aliases are not merged; versions and vendor attribution require source review.
Provider coverage describes currently retained assessments; it does not reconstruct historical risk. Check source freshness separately.