NginxUI
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 32 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from January 11, 2024 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
Nginx UI: Node Secret Credential Exposure via URL Query Parameter
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services
Monitor NginxUI in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.