Known vulnerabilities in nginx-ui

Vendor: Nginx UI
Software: nginx-ui
Software CPE: cpe:2.3:a:nginxui:nginx-ui:*:*:*:*:*:*:*:*
Total vulnerabilities: 71
Public exploits: 7
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting nginx-ui nginx-ui is affected by 71 known vulnerabilities: 9 high, 36 medium, 26 low Critical High Medium Low

Vulnerabilities (71)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU152977 - Incorrect Authorization
CWE-863 Low
No
No
2.6.2 30.09.2026 SB2026093087
#VU152976 - Missing Authorization
CWE-862 Medium
No
No
2.6.2 30.09.2026 SB2026093087
#VU152975 - Type confusion
CWE-843 Medium
No
No
2.6.2 30.09.2026 SB2026093087
#VU152974 - Missing Authorization
CWE-862 Low
No
No
2.6.2 30.09.2026 SB2026093087
#VU152973 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
2.6.2 30.09.2026 SB2026093087
#VU152968 - Incorrect Authorization
CWE-863 Medium
No
No
2.7.0 30.09.2026 SB2026093085
#VU152969 - Insufficient Session Expiration
CWE-613 Medium
No
No
2.7.0 30.09.2026 SB2026093085
#VU142602 - Missing Authorization
CWE-862 Low
No
No
2.5.7 14.08.2026 SB20260814130
#VU138334 - Exposure of sensitive information to an unauthorized actor
CVE-2026-42223
CWE-200 Low
No
No
2.3.8 17.07.2026 SB2026071787
#VU138332 - Missing Authentication for Critical Function
CVE-2026-42221
CWE-306 High
No
No
2.3.8 17.07.2026 SB2026071787
#VU138331 - Exposure of sensitive information to an unauthorized actor
CVE-2026-42220
CWE-200 Low
No
No
2.3.8 17.07.2026 SB2026071787
#VU138330 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-42238
CWE-94 High
No
No
2.3.8 17.07.2026 SB2026071787
#VU127228 - Missing Authentication for Critical Function
CVE-2026-27944
CWE-306 High
Available
No
2.3.3 23.04.2026 SB20260423158
#VU126647 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-22196
CWE-89 Medium
Available
No
2.0.0 beta.9 21.04.2026 SB2024011134
#VU126639 - Command injection
CVE-2024-22198
CWE-77 Medium
Available
No
2.0.0 beta.9 21.04.2026 SB2024011134
#VU127231 - Command injection
CVE-2024-49368
CWE-77 Medium
No
No
2.0.0 21.10.2024 SB2024012801
#VU127230 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-49367
CWE-22 Low
No
No
2.0.0 21.10.2024 SB2024012801
#VU127229 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-49366
CWE-22 Low
No
No
2.0.0 21.10.2024 SB2024012801
#VU127233 - Improper input validation
CVE-2024-23827
CWE-20 Low
No
No
2.0.0 28.01.2024 SB2024012801
#VU127232 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2024-23828
CWE-93 Medium
No
No
2.0.0 28.01.2024 SB2024012801


Showing elements 1 - 20 out of 71