Every CVE whose affected-product data names Nginxui Nginx Ui, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (23)
CVE-2026-27944 — CVSS 9.8 (critical): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without…
CVE-2024-49368 — CVSS 9.8 (critical): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not…
CVE-2026-42238 — CVSS 9.8 (critical): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST…
CVE-2024-23827 — CVSS 9.8 (critical): Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The…
CVE-2026-33032 — CVSS 9.8 (critical): Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol)…
CVE-2026-33026 — CVSS 9.1 (critical): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers…
CVE-2026-33030 — CVSS 8.8 (high): Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object…
CVE-2024-23828 — CVSS 8.8 (high): Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF…
CVE-2026-44015 — CVSS 8.5 (high): Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request…
CVE-2026-34403 — CVSS 8.1 (high): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a…
CVE-2026-42222 — CVSS 8.1 (high): Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui…
CVE-2026-42221 — CVSS 8.1 (high): Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker…
CVE-2026-33031 — CVSS 8.1 (high): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use…
CVE-2024-22197 — CVSS 7.7 (high): Nginx-ui is online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. The…
CVE-2026-33028 — CVSS 7.5 (high): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race…
CVE-2024-49366 — CVSS 7.5 (high): Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without…
CVE-2024-49367 — CVSS 7.5 (high): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This…
CVE-2024-22198 — CVSS 7.1 (high): Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration…
CVE-2024-22196 — CVSS 7.0 (high): Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time…
CVE-2026-42220 — CVSS 6.5 (medium): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and…
CVE-2026-33029 — CVSS 6.5 (medium): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate…
CVE-2026-42223 — CVSS 6.5 (medium): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-…
CVE-2026-33027 — CVSS 6.5 (medium): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles…