CRITICAL9.8Go
GHSA-4pvg-prr3-9cxr· CVE-2026-42238, GO-2026-5129Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore
Modified: 6/25/2026
package
Go/github.com/0xJacky/nginx-ui
pkg:go/github.com/0xJacky/nginx-ui
HIGH8.8Go
GHSA-5hf2-vhj6-gj9m· CVE-2026-33030, GO-2026-4901nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys
Modified: 9/10/2026
HIGH8.1Go
GHSA-mxqh-q9h6-v8pq· CVE-2026-42222, GO-2026-5521Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover
Modified: 6/25/2026
MEDIUM6.5Go
GHSA-q4w7-56hr-83rm· CVE-2026-42223, GO-2026-5565Nginx-UI Settings API Exposes Protected Secrets
Modified: 6/25/2026
—Go
GO-2026-4901· CVE-2026-33030, GHSA-5hf2-vhj6-gj9mnginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys in github.com/0xJacky/nginx-ui
Modified: 4/2/2026
—Go
GO-2026-5129· CVE-2026-42238, GHSA-4pvg-prr3-9cxrNginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore in github.com/0xJacky/nginx-ui
Modified: 6/25/2026
—Go
GO-2026-5521· CVE-2026-42222, GHSA-mxqh-q9h6-v8pqNginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui
Modified: 6/25/2026
—Go
GO-2026-5565· CVE-2026-42223, GHSA-q4w7-56hr-83rmNginx-UI Settings API Exposes Protected Secrets in github.com/0xJacky/nginx-ui
Modified: 6/25/2026