Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
88 results · page 1 of 2
Oct 29, 2026A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface.CVE-2023-7357 · Other software · Revera · reported by PSIRT-CNA@flexerasoftware.comHigh 8.6
A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 (11.19.4.0) release.
- Product
- FlexNet Publisher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-84312 · Other software · 0xJacky · reported by GitHubHigh 7.1
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-84360 · Other software · 0xJacky · reported by GitHubHigh 8.1
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-84321 · Other software · 0xJacky · reported by GitHubMedium 5.4
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the short_token cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-84320 · Other software · 0xJacky · reported by GitHubMedium 6.3
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-84319 · Other software · 0xJacky · reported by GitHubHigh 8.3
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-84318 · Other software · 0xJacky · reported by GitHubHigh 8.8
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-84317 · Other software · 0xJacky · reported by GitHubHigh 8.8
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path — the MCP tool nginx_config_add (mcp/config/config_add.go) — does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-84316 · Other software · 0xJacky · reported by GitHubHigh 8.8
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-84315 · Other software · 0xJacky · reported by GitHubHigh 8.3
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-84314 · Other software · 0xJacky · reported by GitHubHigh 8.7
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-84313 · Other software · 0xJacky · reported by GitHubHigh 8.8
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-107813 · Other software · 0xJacky · reported by GitHubHigh 8.8
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user possessing a stolen or persisted JWT can therefore perform node CRUD, read or replace node credentials, change namespaces, and invoke nodes/reload_nginx or nodes/restart_nginx without a fresh second-factor step-up. This issue is an incomplete fix for CVE-2026-84315 and is fixed in version 2.5.0.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-107812 · Other software · 0xJacky · reported by GitHubHigh 7.5
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI process context on the next upgrade. This issue is fixed in version 2.5.0.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-107811 · Other software · 0xJacky · reported by GitHubHigh 8.8
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node authentication bypass can expose sensitive management operations, including configuration synchronization and service restart. This issue is fixed in version 2.5.0.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-107810 · Other software · 0xJacky · reported by GitHubHigh 8.1
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups can craft a valid backup that places a symlink in the staging tree and then writes a regular file through that link, even when both restore flags are false. This can persistently inject configuration or cause denial of service when the modified files are later consumed. This issue is fixed in version 2.5.0.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-107809 · Other software · 0xJacky · reported by GitHubHigh 8.8
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator's browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim's session. This issue is fixed in version 2.5.0.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-107808 · Other software · 0xJacky · reported by GitHubHigh 8.1
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-107807 · Other software · 0xJacky · reported by GitHubHigh 8.8
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-107806 · Other software · 0xJacky · reported by GitHubCritical 9.4
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-107805 · Other software · 0xJacky · reported by GitHubHigh 7.5
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-107804 · Other software · 0xJacky · reported by GitHubMedium 5.3
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowlist loopback exception, although valid credentials are still required. Failed logins from different external clients are also attributed to the same loopback address, allowing an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication without invalidating existing sessions. This issue is fixed in version 2.6.0.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users.CVE-2026-18371 · Other software · M-Files Corporation · reported by security@m-files.comMedium 5.1
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users.
- Product
- M-Files Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next GeneCVE-2026-25624 · Other software · Arista Networks · reported by psirt@arista.comMedium 5.8
An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vector payload processing behavior controls.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-44015 · Other software · 0xJacky · reported by GitHubHigh 8.5
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42238 · Other software · 0xJacky · reported by GitHubCritical 9
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites the application's configuration file (app.ini) and SQLite database. Because the attacker controls the restored app.ini, they can inject an arbitrary OS command into the TestConfigCmd setting. After the application automatically restarts to apply the restored config, a single follow-up request triggers that command as the user running nginx-ui — typically root in Docker deployments. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42223 · Other software · 0xJacky · reported by GitHubMedium 6.5
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields are tagged with protected:"true" - however, this tag is only enforced during writes (via ProtectedFill in SaveSettings) and is completely ignored during reads. This exposes 40+ protected fields including JwtSecret (enabling auth token forgery), NodeSecret (enabling cluster node impersonation), OIDC ClientSecret (enabling OAuth account takeover), and the IP whitelist configuration. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42222 · Other software · 0xJacky · reported by GitHubHigh 8.1
Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42221 · Other software · 0xJacky · reported by GitHubHigh 8.1
Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /api/install endpoint is reachable without authentication, and the request-encryption flow only protects payload confidentiality in transit; it does not authenticate who is allowed to perform installation. A remote attacker who reaches the service before the legitimate operator can set the admin email, username, and password, causing permanent initial-instance takeover. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-42220 · Other software · 0xJacky · reported by GitHubMedium 6.5
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-34403 · Other software · 0xJacky · reported by GitHubMedium 5.5
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking (CSWSH). Combined with the fact that authentication tokens are stored in browser cookies (set via JavaScript without HttpOnly or explicit SameSite attributes), a malicious webpage can establish authenticated WebSocket connections to the nginx-ui instance when a logged-in administrator visits the attacker-controlled page. Version 2.3.5 patches the issue.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33031 · Other software · 0xJacky · reported by GitHubHigh 8.6
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an attacker who already stole a JWT can continue reading and modifying protected resources after the account is marked disabled. Since tokens can be used to create new accounts, it is possible the disabled user to maintain the privilege. Version 2.3.4 patches the issue.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026ProSoft Technology ICX35-HWC versions 1.3 and prior cellular gateways contain an input validation vulnerability in the web user interface that allows remote attCVE-2017-20236 · Other software · ProSoft Technology · reported by VulnCheckCritical 9.3
ProSoft Technology ICX35-HWC versions 1.3 and prior cellular gateways contain an input validation vulnerability in the web user interface that allows remote attackers to inject and execute system commands by submitting malicious input through unvalidated fields. Attackers can exploit this vulnerability to gain root privileges and execute arbitrary commands on the device through the accessible web interface.
- Product
- ICX35-HWC Cellular Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.belden.comvulncheck.com
Apr 3, 2026ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interface that allows unauthCVE-2017-20235 · Other software · ProSoft Technology · reported by VulnCheckCritical 9.3
ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interface that allows unauthenticated attackers to gain access to administrative functions without valid credentials. Attackers can bypass the authentication mechanism in affected firmware versions to obtain full administrative access to device configuration and settings.
- Product
- ICX35-HWC Cellular Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.belden.comvulncheck.com
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33026 · Other software · 0xJacky · reported by GitHubCritical 9.4
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33032 · Other software · 0xJacky · reported by GitHubCritical 9.8
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". This means any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads - achieving complete nginx service takeover. At time of publication, there are no publicly available patches.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33030 · Other software · 0xJacky · reported by GitHubHigh 8.8
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a user_id field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments. At time of publication, there are no publicly available patches.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33029 · Other software · 0xJacky · reported by GitHubMedium 6.9
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33028 · Other software · 0xJacky · reported by GitHubHigh 7.1
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, concurrent requests lead to the severe corruption of the primary configuration file (app.ini). This vulnerability results in a persistent Denial of Service (DoS) and introduces a non-deterministic path for Remote Code Execution (RCE) through configuration cross-contamination. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-33027 · Other software · 0xJacky · reported by GitHubMedium 6.9
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Dagu is a workflow engine with a built-in Web user interface.CVE-2026-33344 · Other software · dagu-org · reported by GitHubHigh 8.1
Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.
- Product
- dagu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems.CVE-2026-33340 · Other software · ParisNeo · reported by GitHubCritical 9.1
LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in all known existing versions of `lollms-webui`. The `@router.post("/api/proxy")` endpoint allows unauthenticated attackers to force the server into making arbitrary GET requests. This can be exploited to access internal services, scan local networks, or exfiltrate sensitive cloud metadata (e.g., AWS/GCP IAM tokens). As of time of publication, no known patched versions are available.
- Product
- lollms-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026Dagu is a workflow engine with a built-in Web user interface.CVE-2026-31886 · Other software · dagu-org · reported by GitHubCritical 9.1
Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go's filepath.Join resolves .. segments lexically, so a caller can supply a value such as ".." to redirect the computed directory outside the intended /tmp/<name>/<id> path. A deferred cleanup function that calls os.RemoveAll on that directory then runs unconditionally when the HTTP handler returns, deleting whatever directory the traversal resolved to. With dagRunId set to "..", the resolved directory is the system temporary directory (/tmp on Linux). On non-root deployments, os.RemoveAll("/tmp") removes all files in /tmp owned by the dagu process user, disrupting every concurrent dagu run that has live temp files. On root or Docker deployments, the call removes the entire contents of /tmp, causing a system-wide denial of service. This vulnerability is fixed in 2.2.4.
- Product
- dagu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026Dagu is a workflow engine with a built-in Web user interface.CVE-2026-31882 · Other software · dagu-org · reported by GitHubHigh 7.5
Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status — bypassing the authentication that protects the REST API. The buildStreamAuthOptions() function builds authentication options for SSE/streaming endpoints. When the auth mode is basic, it returns an auth.Options struct with BasicAuthEnabled: true but AuthRequired defaults to false (Go zero value). The authentication middleware at internal/service/frontend/auth/middleware.go allows unauthenticated requests when AuthRequired is false. This vulnerability is fixed in 2.2.4.
- Product
- dagu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-27944 · Other software · 0xJacky · reported by GitHubCritical 9.8
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Dagu is a workflow engine with a built-in Web user interface.CVE-2026-27598 · Other software · dagu-org · reported by GitHubHigh 7.1
Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the `CreateNewDAG` API endpoint (`POST /api/v1/dags`) does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files anywhere on the filesystem (limited by the process permissions). Since dagu executes DAG files as shell commands, writing a malicious DAG to the DAGs directory of another instance or overwriting config files can lead to remote code execution. Commit e2ed589105d79273e4e6ac8eb31525f765bb3ce4 fixes the issue.
- Product
- dagu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using theCVE-2025-69929 · Other software · N3uron · reported by MITRECritical 9.8
An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format
- Product
- Web User Interface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comn3uron.com
Nov 3, 2025Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet,CVE-2025-34501 · Other software · Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. · reported by VulnCheckHigh 7
Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds.
- Product
- Deck Mate 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordioactive.comvulncheck.com
Jun 6, 2025Kafbat UI is a web user interface for managing Apache Kafka clusters.CVE-2025-49127 · Other software · kafbat · reported by GitHubHigh 8.9
Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user to execute arbitrary code on the server. Version 1.1.0 fixes the issue.
- Product
- kafka-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024Nginx UI is a web user interface for the Nginx web server.CVE-2024-49368 · Other software · 0xJacky · reported by GitHubHigh 8.9
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.