Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0

Platform

My Vulnerabilities
Insights
Notifications
Account
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Book a demo

Get Started

Sign up
Log in

Legal

Privacy
Terms

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Home
Vendors
Nginxui
Nginx Ui

nginxui nginx ui Vulnerabilities: CVEs, CISA KEV & Security Advisories

23 CVEs

nginxui nginx ui Vulnerabilities

CVE security advisories and vulnerability history for nginx ui by nginxui.

23

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

21

Public exploits

With known exploit

7.9

Avg CVSS

2024–2026

Last updated May 12, 2026

Overview

nginxui nginx ui has 23 published CVE records since 2024, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 21 have a known public exploit. The average CVSS base score across scored CVEs is 7.9.

This page aggregates every publicly disclosed vulnerability (CVE) affecting nginxui nginx ui, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of nginxui nginx ui's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical5

High12

Medium6

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of nginxui nginx ui's CVEs are currently listed in CISA's KEV catalog.

Public exploits

21

21 of nginxui nginx ui's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every nginxui nginx ui version named in a CVE, then pick one to see only the CVEs that affect it.

Fixed in

2.3.45 CVEs
2.0.04 CVEs
2.3.84 CVEs
2.3.31 CVE
2.3.51 CVE

Find a version

23 CVEs

Sort

Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services
CVE-2026-44015
Public exploit
CWE-918
High · CVSS 8.5
EPSS 0.0% (2th pct)2026-05-12
Unauthenticated Remote Code Execution via Backup Restore in nginx-ui
CVE-2026-42238
Public exploit
Patch
CWE-94
Critical · CVSS 9.0
EPSS 0.3% (57th pct)2026-05-04
nginx-ui: Settings API Exposes Protected Secrets
CVE-2026-42223
Public exploit
Patch
CWE-200
Medium · CVSS 6.5
EPSS 0.0% (13th pct)2026-05-04
nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover
CVE-2026-42222
Public exploit
CWE-306
High · CVSS 8.1
EPSS 0.1% (19th pct)2026-05-04
nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim
CVE-2026-42221
Public exploit
Patch
CWE-306
High · CVSS 8.1
EPSS 0.1% (28th pct)2026-05-04
nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback
CVE-2026-42220
Public exploit
Patch
CWE-200
Medium · CVSS 6.5
EPSS 0.0% (12th pct)2026-05-04
Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints
CVE-2026-34403
Public exploit
Patch
CWE-1385
Medium · CVSS 5.5
EPSS 0.0% (13th pct)2026-04-20
Nginx-UI: Disabled users retain full API access through previously issued bearer tokens
CVE-2026-33031
Public exploit
Patch
CWE-284
High · CVSS 8.6
EPSS 0.0% (12th pct)2026-04-20
nginx-ui Backup Restore Allows Tampering with Encrypted Backups
CVE-2026-33026
Public exploit
Patch
CWE-354
Critical · CVSS 9.4
EPSS 0.0% (5th pct)2026-03-30
Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory
CVE-2026-33027
Public exploit
Patch
CWE-73
Medium · CVSS 6.9
EPSS 0.1% (21th pct)2026-03-30
Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse
CVE-2026-33028
Public exploit
Patch
CWE-362
High · CVSS 7.1
EPSS 0.1% (26th pct)2026-03-30
Nginx UI: DoS via Negative Integer Input in Logrotate Interval
CVE-2026-33029
Public exploit
Patch
CWE-20
Medium · CVSS 6.9
EPSS 0.1% (21th pct)2026-03-30
Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys
CVE-2026-33030
Public exploit
CWE-78
High · CVSS 8.8
EPSS 0.0% (13th pct)2026-03-30
Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
CVE-2026-33032
Public exploit
CWE-306
Critical · CVSS 9.8
EPSS 15.4% (95th pct)2026-03-30
Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
CVE-2026-27944
Public exploit
Patch
CWE-306
Critical · CVSS 9.8
EPSS 7.3% (92th pct)2026-03-05
High vulnerability · 2024-10-21
CVE-2024-49368
Patch
CWE-20
High · CVSS 8.9
EPSS 52.2% (98th pct)2024-10-21
Medium vulnerability · 2024-10-21
CVE-2024-49367
Public exploit
Patch
CWE-862
Medium · CVSS 5.5
EPSS 0.6% (69th pct)2024-10-21
High vulnerability · 2024-10-21
CVE-2024-49366
Public exploit
Patch
CWE-22
High · CVSS 7.7
EPSS 0.5% (67th pct)2024-10-21
High vulnerability · 2024-01-29
CVE-2024-23828
Patch
CWE-74
High · CVSS 8.8
EPSS 1.4% (81th pct)2024-01-29
Nginx-UI arbitrary file write through the Import Certificate feature
CVE-2024-23827
Public exploit
Patch
CWE-22
Critical · CVSS 9.8
EPSS 3.0% (87th pct)2024-01-29
High vulnerability · 2024-01-11
CVE-2024-22198
Public exploit
Patch
CWE-77
High · CVSS 7.1
EPSS 16.0% (95th pct)2024-01-11
Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)
CVE-2024-22196
Public exploit
Patch
CWE-89
High · CVSS 7.0
EPSS 0.7% (72th pct)2024-01-11
High vulnerability · 2024-01-11
CVE-2024-22197
Public exploit
Patch
CWE-77
High · CVSS 7.7
EPSS 3.1% (87th pct)2024-01-11

Common weakness types

The CWE weakness categories most often found in nginxui nginx ui CVEs. Follow any weakness for its full explanation.

CWE-306Missing Authentication for Critical Function4 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')2 CVEs
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1 CVE
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')1 CVE
CWE-862Missing Authorization1 CVE

Disclosure activity by year

How many nginxui nginx ui CVEs were published each year.

2024

8

2026

15

Other nginxui products

Browse vulnerabilities for other products by nginxui.

All nginxui vulnerabilities

Frequently asked questions

Common questions about nginxui nginx ui vulnerabilities.

How many CVEs does nginxui nginx ui have?

nginxui nginx ui has 23 published CVE records since 2024.

How many nginxui nginx ui CVEs are in CISA KEV?

None of nginxui nginx ui's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for nginxui nginx ui vulnerabilities?

Yes — 21 of nginxui nginx ui's CVEs have a known public exploit.

Which versions of nginxui nginx ui are affected?

5 distinct nginxui nginx ui versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in nginxui nginx ui CVEs?

nginxui nginx ui's CVEs most often map to these CWE weakness types: CWE-306 (Missing Authentication for Critical Function), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-20 (Improper Input Validation).

How many critical nginxui nginx ui vulnerabilities are there?

nginxui nginx ui has 5 critical and 12 high-severity CVEs.

What is the average severity of nginxui nginx ui CVEs?

The average CVSS base score across nginxui nginx ui's scored CVEs is 7.9.

References

All nginxui vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track nginxui nginx ui vulnerabilities

Monitor new nginxui nginx ui vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References