6716 matches found
GHSA-5HF2-VHJ6-GJ9M nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys
Summary Nginx-UI contains an Insecure Direct Object Reference IDOR vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a userid field, and all resource endpoints perform queries by ID without...
EUVD-2026-17156
nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys...
EUVD-2026-17154
nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval...
Unchecked Input for Loop Condition
Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition due to improper input validation in the POST /api/settings handler for the logrotate.interval field. An attacker can make the web interface unresponsive by submitting a negative interval value, causing...
GHSA-CP8R-8JVW-V3QG nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval
Summary An input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service DoS. By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface...
GHSA-M468-XCM6-FXG4 nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse
Summary The nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms Mutex and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file app.ini. This vulnerability results in a persistent...
nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse
Summary The nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms Mutex and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file app.ini. This vulnerability results in a persistent...
EUVD-2026-17152
nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse...
EUVD-2026-17151
Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation...
Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation
Summary The nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory /etc/nginx. In particular, this allows an...
GHSA-M8P8-53VF-8357 Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation
Summary The nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory /etc/nginx. In particular, this allows an...
EUVD-2026-17194
nginx-ui Backup Restore Allows Tampering with Encrypted Backups...
nginx-ui Backup Restore Allows Tampering with Encrypted Backups
Summary The nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. Details The backup format lacks a trusted integrity root. Although files are encrypted, the encryption key and IV are provided to the clie...
GHSA-FHH2-GG7W-GWPQ nginx-ui Backup Restore Allows Tampering with Encrypted Backups
Summary The nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. Details The backup format lacks a trusted integrity root. Although files are encrypted, the encryption key and IV are provided to the clie...
CVE-2026-28755 affecting package nginx for versions less than 1.22.1-16
CVE-2026-28755 affecting package nginx for versions less than 1.22.1-16. A patched version of the package is available...
CVE-2026-27784 affecting package nginx for versions less than 1.22.1-16
CVE-2026-27784 affecting package nginx for versions less than 1.22.1-16. A patched version of the package is available...
CVE-2026-32647 affecting package nginx for versions less than 1.22.1-16
CVE-2026-32647 affecting package nginx for versions less than 1.22.1-16. A patched version of the package is available...
CVE-2026-27651 affecting package nginx for versions less than 1.22.1-16
CVE-2026-27651 affecting package nginx for versions less than 1.22.1-16. A patched version of the package is available...