GHSA-9H23-53F4-Q947 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in...

Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in...

GHSA-P393-CF76-4JMR Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Summary An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2523 6c86e5a5 in the local...

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Summary An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2523 6c86e5a5 in the local...

Malicious Package

Overview @tvg-mar/tvg-promos-atomic-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-106372

An incorrect authorization flaw was found in the UI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/557288890...

CVE-2026-106337

An ui misrepresentation flaw was found in the UI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553145497...

CVE-2026-106229

An ui misrepresentation flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/521949525...

CVE-2026-106209

An ui misrepresentation flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/518039724...

CVE-2026-106282

An ui misrepresentation flaw was found in the WebOTP component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514204338...

CVE-2026-106182

An ui misrepresentation flaw was found in the Paint component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514078734...

GHSA-9Q47-3CM2-2RP8 pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied X-Forwarded-For XFF HTTP header and taking the leftmost value. No trusted-proxy configuration exists the Cheroot WSGI server faces clients directly, and...

GHSA-662P-52HX-CMH2 Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

Summary The self-upgrade downloads the release binary and its checksum .tar.gz and .tar.gz.digest through the SAME endpoint version.GetUrl, which is githubproxy or, by default, the project's cloud.nginxui.com mirror, and verifies the binary ONLY by comparing it to that digest: digestFileContent =...

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

Summary The self-upgrade downloads the release binary and its checksum .tar.gz and .tar.gz.digest through the SAME endpoint version.GetUrl, which is githubproxy or, by default, the project's cloud.nginxui.com mirror, and verifies the binary ONLY by comparing it to that digest: digestFileContent =...

GHSA-45GV-9WJV-XH7P Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Summary nginx-ui supports two second-factor methods — TOTP OTP and WebAuthn passkeys — and reports an account as 2FA-enabled when either is configured. However, the password login endpoint POST /api/login only enforces a second factor when a TOTP secret is present. An account that has registered ...

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Summary nginx-ui supports two second-factor methods — TOTP OTP and WebAuthn passkeys — and reports an account as 2FA-enabled when either is configured. However, the password login endpoint POST /api/login only enforces a second factor when a TOTP secret is present. An account that has registered ...

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named token and the AuthRequired middleware accepts that cookie as an authentication source. Because management endpoints are protected by AuthRequired and do not enforce a universal CSRF token or Origin/Referer check, a remote attack...

GHSA-33RR-WQ23-G6GG Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named token and the AuthRequired middleware accepts that cookie as an authentication source. Because management endpoints are protected by AuthRequired and do not enforce a universal CSRF token or Origin/Referer check, a remote attack...

GHSA-H246-WPGF-VMQ5 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session OTP step-up requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a J...

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session OTP step-up requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a J...