CVE-2026-84318: Protection Mechanism Failure

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-84321: Insufficient Session Expiration

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain i...

CVE-2026-84360: Authentication Bypass Using an Alternate Path or Channel

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcpmessage require only ordinary authentication before exposing nginxconfigadd and nginxconfigmodify. An OTP-enabled user with a normal JWT...

CVE-2026-84314: Improper Authorization

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up...

CVE-2026-84316: Improper Input Validation

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84319: Protection Mechanism Failure

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivale...

PT-2026-110954

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description The GenerateShortToken function creates standalone short-token records that lack a long Token value. However, the DeleteUserTokens function only invalidates cached entries when the long Token field ...

PT-2026-110890

Name of the Vulnerable Software and Affected Versions IBM Db2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 Description An unauthenticated attacker can embed arbitrary JavaScript code into the Web UI. This cross-site scripting issue allows the attacker to alter the intended...

CVE-2026-109373: Unintended Proxy or Intermediary

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them wi...

CVE-2026-109371: Missing Authentication for Critical Function

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...

CVE-2026-108901: Improper Restriction of Rendered UI Layers or Frames

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack ca...

PT-2026-110797

Name of the Vulnerable Software and Affected Versions Netcore NR268 version 1.7.121109 Description Cross site scripting occurs in the Web UI component due to improper handling of the title, note, URL, and content arguments within the eval function of the '/router/l7 call board user set.cgi'...

PT-2026-110973

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description The GetCasdoorUri function uses the configured Casdoor application name as a constant OAuth state value, and the CasdoorCallback function fails to compare the submitted state with a value bound to t...

PT-2026-110953

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.3 Description An authenticated user can manipulate the backup process by creating or modifying an automatic backup. The AutoBackup.GetName function returns a user-controlled name that does not reject path...

PT-2026-110977

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description An authentication bypass exists where the /mcp and /mcp message endpoints only require ordinary authentication, unlike other HTTP configuration mutation routes that require a secure session. This...

PT-2026-110891

Name of the Vulnerable Software and Affected Versions IBM Db2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 Description An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI. This cross-site scripting issue allows the attacker to alter intended functionality...

PT-2026-110975

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description An authenticated MCP caller or an MCP agent induced via prompt injection can bypass security controls to inject dangerous Nginx directives. While the ValidateConfigFile function in...

PT-2026-110974

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description An authenticated user can bypass configuration validation because the config.ValidateConfigDirectives function only checks the first directive token on each line, ignoring subsequent...

PT-2026-110951

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description An authenticated user can change the password of another user via the 'POST /api/users/:id' endpoint without completing the RequireSecureSession step-up authentication. This allows an attacker with ...

CVE-2026-84320: Improper Limitation of a Pathname to a Restricted Directory

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storagepath, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that...