GHSA-H246-WPGF-VMQ5 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session OTP step-up requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a J...

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session OTP step-up requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a J...

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the restore staging process to write attacker-controlled files into the live Nginx configuration path even when both restorenginx and restorenginxui are set to false. Details The restore...

GHSA-P8V3-89RH-JXC7 Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the restore staging process to write attacker-controlled files into the live Nginx configuration path even when both restorenginx and restorenginxui are set to false. Details The restore...

WordPress Data Tables Generator by Supsystic plugin <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by braintx in WordPress Plugin Data Tables Generator by Supsystic versions = 1.15.1...

WordPress Data Tables Generator by Supsystic plugin <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Data Tables Generator by Supsystic versions = 1.12.03...

CVE-2026-107810

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restorenginx and restorenginxui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create an...

CVE-2026-107815

The MariaDB server (versions 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2) contains a one-byte out-of-bounds (OOB) write in the CONNECT engine 's DOS table type. The vulnerability is caused by an incorrect boundary check , allowing an attacker-controlled offset to trigger...

EUVD-2026-95909

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

Helicone server request forgery vulnerability

Helicone v2025.08.21-1 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from the Jawn webhook sender’s server-side request forgeing feature, which allows authenticated organizational users to access internal services by accessing hostnames that poin...

WordPress PeproDev Ultimate Profile Solutions Cross-Site Script Vulnerabilities

WordPress PeproDev Ultimate Profile Solutions versions 8.2.36 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper input cleaning and output escaping of the button attribute in the logout-url shortcode, allowing authenticated attackers to inject arbitrary...

CVE-2026-107813

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...

CVE-2026-107811 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...

EUVD-2026-95894

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restorenginx and restorenginxui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create an...

CVE-2026-107810

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restorenginx and restorenginxui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create an...

CVE-2026-107810

The Nginx UI web interface (versions 2.0.0 through 2.5.0 ) is vulnerable to a symlink traversal issue in internal/backup/restore.go. The application extracts archives and follows crafted symlinks targeting the live Nginx configuration path before applying necessary restore flags. An authenticated...

CVE-2026-107810 Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restorenginx and restorenginxui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create an...

CVE-2026-107806

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

CVE-2026-108111 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...

CVE-2026-108111

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or ispublic filtering, to list enabled private workflows in the sa...