CVE-2026-106337

An ui misrepresentation flaw was found in the UI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553145497...

CVE-2026-106229

An ui misrepresentation flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/521949525...

CVE-2026-106209

An ui misrepresentation flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/518039724...

CVE-2026-106282

An ui misrepresentation flaw was found in the WebOTP component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514204338...

CVE-2026-106182

An ui misrepresentation flaw was found in the Paint component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514078734...

GHSA-9Q47-3CM2-2RP8 pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied X-Forwarded-For XFF HTTP header and taking the leftmost value. No trusted-proxy configuration exists the Cheroot WSGI server faces clients directly, and...

GHSA-662P-52HX-CMH2 Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

Summary The self-upgrade downloads the release binary and its checksum .tar.gz and .tar.gz.digest through the SAME endpoint version.GetUrl, which is githubproxy or, by default, the project's cloud.nginxui.com mirror, and verifies the binary ONLY by comparing it to that digest: digestFileContent =...

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

Summary The self-upgrade downloads the release binary and its checksum .tar.gz and .tar.gz.digest through the SAME endpoint version.GetUrl, which is githubproxy or, by default, the project's cloud.nginxui.com mirror, and verifies the binary ONLY by comparing it to that digest: digestFileContent =...

GHSA-45GV-9WJV-XH7P Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Summary nginx-ui supports two second-factor methods — TOTP OTP and WebAuthn passkeys — and reports an account as 2FA-enabled when either is configured. However, the password login endpoint POST /api/login only enforces a second factor when a TOTP secret is present. An account that has registered ...

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Summary nginx-ui supports two second-factor methods — TOTP OTP and WebAuthn passkeys — and reports an account as 2FA-enabled when either is configured. However, the password login endpoint POST /api/login only enforces a second factor when a TOTP secret is present. An account that has registered ...

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named token and the AuthRequired middleware accepts that cookie as an authentication source. Because management endpoints are protected by AuthRequired and do not enforce a universal CSRF token or Origin/Referer check, a remote attack...

GHSA-33RR-WQ23-G6GG Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named token and the AuthRequired middleware accepts that cookie as an authentication source. Because management endpoints are protected by AuthRequired and do not enforce a universal CSRF token or Origin/Referer check, a remote attack...

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session OTP step-up requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a J...

GHSA-H246-WPGF-VMQ5 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session OTP step-up requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a J...

GHSA-32GC-WF3M-78W9 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Summary 0xJacky/nginx-ui contains a high-severity trust-boundary failure between ordinary users and cluster node credentials. The source code shows that cluster node list and detail endpoints are reachable by ordinary authenticated users and return node objects containing the token field. That sa...

GHSA-PVGV-GCP7-V38G Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Vulnerability Summary nginx-ui's Node.Secret is a master credential that bypasses all JWT/password authentication for the entire API. The application accepts this credential via a URL query parameter ?nodesecret=, causing it to be recorded in plaintext in HTTP access logs, reverse proxy logs,...

GHSA-P8V3-89RH-JXC7 Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the restore staging process to write attacker-controlled files into the live Nginx configuration path even when both restorenginx and restorenginxui are set to false. Details The restore...

CVE-2026-106265

An ui misrepresentation flaw was found in the File component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/380789337...

CVE-2026-107813

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...

CVE-2026-107809

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or...