Skip to content
OpenAdvisories

Package · Go

github.com/0xJacky/Nginx-UI

41 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-107806 Public exploit

    Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

    Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The resto…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • Critical 9.8
    CVE-2026-33032 Public exploit Scanner template EPSS 35%

    Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

    Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthR…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • Critical 9.8
    CVE-2026-27944 Public exploit Scanner template EPSS 23%

    Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This al…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go