CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 30, 2026, 4:23 AM ET)

What this means for you

This week: 3,336 CVEs published, 226 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,336; Show in the list
Critical, last 7 days: 226; Show in the list
Healthcare-tagged, last 7 days: 3; Show in the list
Known exploited (CISA KEV): 1,764; Show in the list

Showing CVEs that name the product nginxui:nginx_ui. Show all products

24 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-107813	High 8.8	Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up Assigned by GitHub_M	Oct 9, 2026
CVE-2026-107812	High 7.5	Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM Assigned by GitHub_M	Oct 9, 2026
CVE-2026-107811	High 8.8	0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser Assigned by GitHub_M	Oct 9, 2026
CVE-2026-107810	High 8.1	Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied Assigned by GitHub_M	Oct 9, 2026
CVE-2026-107809	High 8.8	Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs Assigned by GitHub_M	Oct 9, 2026
CVE-2026-107808	High 8.1	Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) Assigned by GitHub_M	Oct 9, 2026
CVE-2026-107807	High 8.8	Nginx UI: Node Secret Credential Exposure via URL Query Parameter Assigned by GitHub_M	Oct 9, 2026
CVE-2026-107806	Critical 9.4	Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite Assigned by GitHub_M	Oct 9, 2026
CVE-2026-107805	High 7.5	Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage Assigned by GitHub_M	Oct 9, 2026
CVE-2026-44015	High 8.5	Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services Assigned by GitHub_M	May 12, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.