Known vulnerabilities in nginx-ui 1.2.2

Vendor: Nginx UI
Software: nginx-ui
Version: 1.2.2
Software CPE: cpe:2.3:a:nginxui:nginx-ui:*:*:*:*:*:*:*:*
Total vulnerabilities: 23
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting nginx-ui version 1.2.2 nginx-ui 1.2.2 is affected by 23 vulnerabilities: 2 high, 10 medium, 11 low Critical High Medium Low

Vulnerabilities (23)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU142585 - Improper Authorization
CWE-285 Medium
No
No
2.3.9 14.08.2026 SB20260814128
#VU142584 - Authentication Bypass Using an Alternate Path or Channel
CWE-288 Medium
No
No
2.4.1 14.08.2026 SB20260814127
#VU142583 - Insufficient Session Expiration
CWE-613 Low
No
No
2.4.1 14.08.2026 SB20260814127
#VU142582 - Improper Authentication
CWE-287 Medium
No
No
2.3.10 14.08.2026 SB20260814126
#VU142581 - Cross-Site Request Forgery (CSRF)
CWE-352 Medium
No
No
2.3.10 14.08.2026 SB20260814126
#VU142580 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Low
No
No
2.3.11 14.08.2026 SB2026071789
#VU138337 - Missing Authorization
CWE-862 Medium
No
No
2.3.11 17.07.2026 SB2026071789
#VU138336 - Improper input validation
CWE-20 Medium
No
No
2.4.0 17.07.2026 SB2026071788
#VU138335 - Improper input validation
CWE-20 Medium
No
No
2.4.0 17.07.2026 SB2026071788
#VU138334 - Exposure of sensitive information to an unauthorized actor
CVE-2026-42223
CWE-200 Low
No
No
2.3.8 17.07.2026 SB2026071787
#VU138331 - Exposure of sensitive information to an unauthorized actor
CVE-2026-42220
CWE-200 Low
No
No
2.3.8 17.07.2026 SB2026071787
#VU138330 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-42238
CWE-94 High
No
No
2.3.8 17.07.2026 SB2026071787
#VU127234 - Server-Side Request Forgery (SSRF)
CVE-2026-44015
CWE-918 Medium
No
No
2.3.5 23.04.2026 SB2026042135
#VU127228 - Missing Authentication for Critical Function
CVE-2026-27944
CWE-306 High
Public exploit available
No
2.3.3 23.04.2026 SB20260423158
#VU126941 - Improper input validation
CVE-2026-33029
CWE-20 Low
No
No
2.3.4 23.04.2026 SB2026042136
#VU126940 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2026-33028
CWE-362 Low
No
No
2.3.4 23.04.2026 SB2026042136
#VU126939 - Improper Validation of Integrity Check Value
CVE-2026-33026
CWE-354 Low
No
No
2.3.4 23.04.2026 SB2026042136
#VU126938 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-33027
CWE-22 Low
No
No
2.3.4 23.04.2026 SB2026042136
#VU127233 - Improper input validation
CVE-2024-23827
CWE-20 Low
No
No
2.0.0 28.01.2024 SB2024012801
#VU127232 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2024-23828
CWE-93 Medium
No
No
2.0.0 28.01.2024 SB2024012801


Showing elements 1 - 20 out of 23