nging vulnerabilities

CVEs whose affected-version data names the nging package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-119653Medium· 4.3

1w ago

Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-man…

▾ Sunlitadmpub · ngingEPSS 0.35%via CVEORG