CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,136 CVEs published, 234 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,136
Show in the list
Critical, last 7 days
234
Show in the list
Healthcare-tagged, last 7 days
9
Show in the list
Known exploited (CISA KEV)
1,760
Show in the list

Showing CVEs that name the product 0xjacky:nginx_ui. Show all products

36 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-84312High 7.1Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-84360High 8.1Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-84316High 8.8Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-84319High 8.3Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-84317High 8.8Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-84313High 8.8Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-84321Medium 5.4Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-84314High 8.7Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-84320Medium 6.3Nginx UI: Auto backup name allows path traversal outside validated storage path
Assigned by GitHub_M
Oct 12, 2026
CVE-2026-84318High 8.8Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Assigned by GitHub_M
Oct 12, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.