—Go
GO-2026-5719· CVE-2026-44015, GHSA-wr32-99hh-6f35Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services in github.com/0xJacky/Nginx-UI
Modified: 6/25/2026
package
Go/github.com/0xJacky/Nginx-UI
pkg:go/github.com/0xJacky/Nginx-UI
—Go
GO-2026-5733· CVE-2026-33031, GHSA-x234-x5vq-cc2vNginx-UI: Disabled users retain full API access through previously issued bearer tokens in github.com/0xJacky/Nginx-UI
Modified: 6/25/2026
HIGH8.1Go
GHSA-78mf-482w-62qj· CVE-2026-34403, GO-2026-5210Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints
Modified: 6/25/2026
MEDIUM6.5Go
GHSA-7jrr-xw9c-mj39· CVE-2026-42220, GO-2026-5227Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback
Modified: 7/21/2026
HIGH7.1Go
GHSA-8r25-68wm-jw35· CVE-2024-22198, GO-2024-2462Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)
Modified: 7/6/2026
MEDIUMGo
GHSA-cp8r-8jvw-v3qg· CVE-2026-33029, GO-2026-4902nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval
Modified: 9/10/2026
CRITICALGo
GHSA-fhh2-gg7w-gwpq· CVE-2026-33026, GO-2026-4903nginx-ui Backup Restore Allows Tampering with Encrypted Backups
Modified: 7/6/2026
CRITICAL9.8Go
GHSA-g9w5-qffc-6762· CVE-2026-27944, GO-2026-4614Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure
Modified: 3/23/2026
HIGH8.1Go
GHSA-h27v-ph7w-m9fp· CVE-2026-42221, GO-2026-5412Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim
Modified: 6/25/2026
HIGH7.0Go
GHSA-h374-mm57-879c· CVE-2024-22196, GO-2024-2463Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)
Modified: 7/6/2026
CRITICAL9.8Go
GHSA-h6c2-x2m2-mwhf· CVE-2026-33032, GO-2026-4904nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
Modified: 9/10/2026
HIGHGo
GHSA-m468-xcm6-fxg4· CVE-2026-33028, GO-2026-4906nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse
Modified: 9/10/2026
MEDIUMGo
GHSA-m8p8-53vf-8357· CVE-2026-33027, GO-2026-4907Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation
Modified: 9/10/2026
HIGH7.7Go
GHSA-pxmr-q2x3-9x9m· CVE-2024-22197, GO-2024-2464Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)
Modified: 7/6/2026
HIGH8.8Go
GHSA-qcjq-7f7v-pvc8· CVE-2024-23828, GO-2024-2480Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF
Modified: 7/6/2026
HIGH8.5Go
GHSA-wr32-99hh-6f35· CVE-2026-44015, GO-2026-5719Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services
Modified: 6/25/2026
HIGH8.1Go
GHSA-x234-x5vq-cc2v· CVE-2026-33031, GO-2026-5733Nginx-UI: Disabled users retain full API access through previously issued bearer tokens
Modified: 6/25/2026
CRITICAL9.8Go
GHSA-xvq9-4vpv-227m· CVE-2024-23827, GO-2024-2481Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature
Modified: 7/6/2026
—Go
GO-2024-2462· CVE-2024-22198, GHSA-8r25-68wm-jw35Arbitrary command execution in github.com/0xJacky/Nginx-UI
Modified: 5/20/2024
—Go
GO-2024-2463· CVE-2024-22196, GHSA-h374-mm57-879cSQL injection in github.com/0xJacky/Nginx-UI
Modified: 5/20/2024
—Go
GO-2024-2464· CVE-2024-22197, GHSA-pxmr-q2x3-9x9mRemote command execution in github.com/0xJacky/Nginx-UI
Modified: 5/20/2024
—Go
GO-2024-2480· CVE-2024-23828, GHSA-qcjq-7f7v-pvc8Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF in github.com/0xJacky/Nginx-UI
Modified: 7/9/2024
—Go
GO-2024-2481· CVE-2024-23827, GHSA-xvq9-4vpv-227mNginx-UI vulnerable to arbitrary file write through the Import Certificate feature in github.com/0xJacky/Nginx-UI
Modified: 7/9/2024
—Go
GO-2026-4614· CVE-2026-27944, GHSA-g9w5-qffc-6762Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure in github.com/0xJacky/Nginx-UI
Modified: 3/23/2026
—Go
GO-2026-4902· CVE-2026-33029, GHSA-cp8r-8jvw-v3qgnginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval in github.com/0xJacky/Nginx-UI
Modified: 4/2/2026
—Go
GO-2026-4903· CVE-2026-33026, GHSA-fhh2-gg7w-gwpqnginx-ui Backup Restore Allows Tampering with Encrypted Backups in github.com/0xJacky/Nginx-UI
Modified: 4/2/2026
—Go
GO-2026-4904· CVE-2026-33032, GHSA-h6c2-x2m2-mwhfnginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover in github.com/0xJacky/Nginx-UI
Modified: 4/2/2026
—Go
GO-2026-4906· CVE-2026-33028, GHSA-m468-xcm6-fxg4nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse in github.com/0xJacky/Nginx-UI
Modified: 4/2/2026
—Go
GO-2026-4907· CVE-2026-33027, GHSA-m8p8-53vf-8357Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation in github.com/0xJacky/Nginx-UI
Modified: 4/2/2026
—Go
GO-2026-5210· CVE-2026-34403, GHSA-78mf-482w-62qjNginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints in github.com/0xJacky/Nginx-UI
Modified: 6/25/2026
—Go
GO-2026-5227· CVE-2026-42220, GHSA-7jrr-xw9c-mj39Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback in github.com/0xJacky/Nginx-UI
Modified: 6/25/2026
—Go
GO-2026-5412· CVE-2026-42221, GHSA-h27v-ph7w-m9fpNginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI
Modified: 6/25/2026