PT-2026-29089

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.4 Description Nginx UI is susceptible to a race condition due to the absence of synchronization mechanisms and non-atomic file writes. Concurrent requests can severely corrupt the primary configuration file...

Nginx UI 安全漏洞

Nginx UI is a web interface for Nginx developed by Jacky. Versions of Nginx UI 2.3.5 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the MCP integration, where the /mcmessage endpoint only applied an IP white list, and the default white list was empty. This...

Nginx UI 输入验证错误漏洞

Nginx UI is a web interface for Nginx developed by Jacky. Versions of Nginx UI prior to 2.3.4 contained a vulnerability related to input validation. This vulnerability stemmed from issues with input validation in the logrotate configuration. It allowed authenticated users to cause the web interfa...

PT-2026-29023

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 11.8 through 11.12.4+541730 WatchGuard Fireware OS versions 12.0 through 12.11.8 WatchGuard Fireware OS versions 2025.1 through 2026.1.2 Description A Cross-Site Request Forgery CSRF issue in the Fireware OS Web...

PT-2026-29088

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.4 Description Nginx UI improperly handles URL-encoded traversal sequences in its configuration, potentially leading to a partial Denial of Service. Specifically, specially crafted paths can cause the backend to...

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

The nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration...

Nginx UI 安全漏洞

Nginx UI is a web interface for Nginx developed by Jacky. Versions of Nginx UI prior to 2.3.4 contained security vulnerabilities. These vulnerabilities stemmed from improper handling of URL-encoded traversal sequences, which could allow authenticated users to delete the entire /etc/nginx director...

PT-2026-33146

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.101 Description An out of bounds read in the Media component allows a remote attacker to execute arbitrary code. This occurs when a user is convinced to perform specific UI gestures while interacting...

CVE-2026-33029

creationtimestamp| type| source ---|---|--- 2026-03-28 03:20:34+00:00| published-proof-of-concept| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cp8r-8jvw-v3qg...

CVE-2026-33027

creationtimestamp| type| source ---|---|--- 2026-03-28 03:19:28+00:00| published-proof-of-concept| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357...

OpenUI 代码注入漏洞

OpenUI is an open source UI program. A cross-site scripting vulnerability exists in OpenUI 1.0 and earlier versions. The vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the file frontend/public/annotator/index.html, which can be exploited by an...

EUVD-2026-16490

Local Incus UI web server vulnerable to nuthentication bypass...

GHSA-HXV8-4J4R-CQGV vulnerabilities

Vulnerabilities for packages: kubescape-operator, hubble-ui, hubble, kubescape...

CVE-2026-33726 vulnerabilities

Vulnerabilities for packages: kubescape-operator, hubble-ui, hubble, kubescape...

CVE-2026-33726 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, hubble-ui, hubble-ui-backend-fips, hubble-fips, kubescape-operator, kubescape-operator-fips, kubescape, kubescape-server, hubble...

EUVD-2026-16420

In the Drupal 7 Internationalization i18n module, the i18nnode submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls an...

CVE-2026-28786

creationtimestamp| type| source ---|---|--- 2026-03-26 23:29:07+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-vvxm-vxmr-624h...

CVE-2026-29071

creationtimestamp| type| source ---|---|--- 2026-03-26 23:27:51+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-w9f8-gxf9-rhvw...

CVE-2026-33898 Local Incus UI web server vulnerable to nuthentication bypass

Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by incus webui incorrectly validates the authentication token such that an invalid value will be accepted. incus webui runs a local web server on a random localhost port. For authentication, i...

CVE-2026-0748 Access bypass in Drupal 7 i18n_node translation UI

In the Drupal 7 Internationalization i18n module, the i18nnode submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls an...