0xJacky has 23 CVEs on record. Disclosure cadence is accelerating: 21 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 21. The median CVSS is 8.3 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (4) and CWE-287 (3). Most affected products: github.com/0xJacky/Nginx-UI (12), nginx-ui (11).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.3
- Publish → KEV
- —
- Last 90 days
- 21 prev 1
Products
- github.com/0xJacky/Nginx-UI 12
- nginx-ui 11
Worst active — by depth score
CVE-2026-107806Critical· 9.4Nginx UI is a web user interface for the Nginx web server64CVE-2026-84318High· 8.8Nginx UI is a web user interface for the Nginx web server61CVE-2026-84316High· 8.8Nginx UI is a web user interface for the Nginx web server61CVE-2026-84313High· 8.8Nginx UI is a web user interface for the Nginx web server61CVE-2026-84317High· 8.8Nginx UI is a web user interface for the Nginx web server60
0xJacky vulnerabilities
CVEs affecting 0xJacky, newest first. Open any entry for full detail, references, and exploit status.
23 CVEsRSS
CVE-2026-84312High· 7.1PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value b…
CVE-2026-84360High· 8.1PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_a…
CVE-2026-84321Medium· 5.4PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token fie…
CVE-2026-84320Medium· 6.3Nginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory…
CVE-2026-84319High· 8.3Nginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface al…
CVE-2026-84318High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The id…
CVE-2026-84317High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl module…
CVE-2026-84316High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolo…
CVE-2026-84315High· 8.3PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Sess…
CVE-2026-84314High· 8.7PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though…
CVE-2026-84313High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying…
CVE-2026-107813High· 8.8Nginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without Re…
CVE-2026-107812High· 7.5PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or net…
CVE-2026-107811High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Nod…
CVE-2026-107810High· 8.1PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Ng…
CVE-2026-107809High· 8.8Nginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints d…
CVE-2026-107808High· 8.1PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only a…
CVE-2026-107807High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring…
CVE-2026-107806Critical· 9.4PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /…
CVE-2026-107805High· 7.5Nginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the bo…
CVE-2026-107804Medium· 5.3Nginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management re…
CVE-2026-42220Medium· 6.5Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and r…
Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback
CVE-2026-33030High· 8.8nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys
nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys