Nginx UI
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 14 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from April 20, 2026 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
Nginx UI: Auto backup name allows path traversal outside validated storage path
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
Nginx UI: Node Secret Credential Exposure via URL Query Parameter
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Monitor Nginx UI in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.