PT-2026-109637

Name of the Vulnerable Software and Affected Versions Kendo UI for Vue @progress/kendo-vue-charts versions 2.5.0 through 16.1.0 Description The default Chart tooltip renders formatted point values as raw HTML without encoding in both single-point and shared tooltips. An attacker with low privileg...

PT-2026-114460

Уязвимость пользовательского интерфейса Nginx UI сервера nginx связана с неверным управлением генерацией кода. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код...

GHSA-J3HG-9RP3-5HW9 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the AP...

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the AP...

GHSA-9H23-53F4-Q947 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in...

Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in...

GHSA-P393-CF76-4JMR Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Summary An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2523 6c86e5a5 in the local...

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Summary An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2523 6c86e5a5 in the local...

Malicious Package

Overview @tvg-mar/tvg-promos-atomic-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-106372

An incorrect authorization flaw was found in the UI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/557288890...

CVE-2026-106337

An ui misrepresentation flaw was found in the UI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553145497...

CVE-2026-106229

An ui misrepresentation flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/521949525...

CVE-2026-106209

An ui misrepresentation flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/518039724...

CVE-2026-106282

An ui misrepresentation flaw was found in the WebOTP component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514204338...

CVE-2026-106182

An ui misrepresentation flaw was found in the Paint component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514078734...

GHSA-9Q47-3CM2-2RP8 pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied X-Forwarded-For XFF HTTP header and taking the leftmost value. No trusted-proxy configuration exists the Cheroot WSGI server faces clients directly, and...

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

Summary The self-upgrade downloads the release binary and its checksum .tar.gz and .tar.gz.digest through the SAME endpoint version.GetUrl, which is githubproxy or, by default, the project's cloud.nginxui.com mirror, and verifies the binary ONLY by comparing it to that digest: digestFileContent =...

GHSA-662P-52HX-CMH2 Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

Summary The self-upgrade downloads the release binary and its checksum .tar.gz and .tar.gz.digest through the SAME endpoint version.GetUrl, which is githubproxy or, by default, the project's cloud.nginxui.com mirror, and verifies the binary ONLY by comparing it to that digest: digestFileContent =...

GHSA-45GV-9WJV-XH7P Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Summary nginx-ui supports two second-factor methods — TOTP OTP and WebAuthn passkeys — and reports an account as 2FA-enabled when either is configured. However, the password login endpoint POST /api/login only enforces a second factor when a TOTP secret is present. An account that has registered ...

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Summary nginx-ui supports two second-factor methods — TOTP OTP and WebAuthn passkeys — and reports an account as 2FA-enabled when either is configured. However, the password login endpoint POST /api/login only enforces a second factor when a TOTP secret is present. An account that has registered ...