{"schema_version":1,"title":"Nginx UI vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 11 vulnerabilities in Nginx UI: 0 in the last 7 days and 11 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-84312, was published on 12 October 2026. 7 vulnerabilities in the last four weeks, up 75% on the four before (4).","url":"https://junglewise.ai/threats/technologies/nginx-ui-nginx-ui","json_url":"https://junglewise.ai/threats/technologies/nginx-ui-nginx-ui.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/nginx-ui-nginx-ui","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":9,"all_time":11,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":11,"last_365_days":11},"latest":[{"cve":"CVE-2026-84312","cvss":7.1,"epss":0.0018,"slug":"cve-2026-84312-nginx-ui-casdoor-sso-callback-uses-a-constant-state-parameter","title":"Nginx UI Casdoor SSO login CSRF via constant state parameter","severity":"high","exploited":false,"published_at":"2026-10-12T22:17:05.263+00:00","url":"https://junglewise.ai/threats/cve-2026-84312-nginx-ui-casdoor-sso-callback-uses-a-constant-state-parameter"},{"cve":"CVE-2026-84360","cvss":8.1,"epss":0.0035,"slug":"cve-2026-84360-nginx-ui-otp-secure-session-step-up-can-be-bypassed-via-mcp","title":"Nginx UI OTP secure-session step-up bypass via MCP","severity":"high","exploited":false,"published_at":"2026-10-12T21:17:22.96+00:00","url":"https://junglewise.ai/threats/cve-2026-84360-nginx-ui-otp-secure-session-step-up-can-be-bypassed-via-mcp"},{"cve":"CVE-2026-84321","cvss":5.4,"epss":0.0021,"slug":"cve-2026-84321-nginx-ui-standalone-short-tokens-survive-administrative","title":"Nginx UI short token cache bypass after account re-enable","severity":"medium","exploited":false,"published_at":"2026-10-12T21:17:22.817+00:00","url":"https://junglewise.ai/threats/cve-2026-84321-nginx-ui-standalone-short-tokens-survive-administrative"},{"cve":"CVE-2026-84320","cvss":6.3,"epss":0.0017,"slug":"cve-2026-84320-nginx-ui-auto-backup-name-allows-path-traversal-outside-validated","title":"Nginx UI auto backup path traversal in storage boundary","severity":"medium","exploited":false,"published_at":"2026-10-12T21:17:22.663+00:00","url":"https://junglewise.ai/threats/cve-2026-84320-nginx-ui-auto-backup-name-allows-path-traversal-outside-validated"},{"cve":"CVE-2026-84318","cvss":8.8,"epss":0.0062,"slug":"cve-2026-84318-nginx-ui-mcp-nginx-config-add-bypasses-directive-validation","title":"nginx-ui MCP nginx_config_add directive validation bypass","severity":"high","exploited":false,"published_at":"2026-10-12T21:17:22.36+00:00","url":"https://junglewise.ai/threats/cve-2026-84318-nginx-ui-mcp-nginx-config-add-bypasses-directive-validation"},{"cve":"CVE-2026-84317","cvss":8.8,"epss":0.0038,"slug":"cve-2026-84317-nginx-ui-mcp-nginx-config-add-skips-config-directive-validation","title":"Nginx UI nginx_config_add directive validation bypass","severity":"high","exploited":false,"published_at":"2026-10-12T21:17:22.213+00:00","url":"https://junglewise.ai/threats/cve-2026-84317-nginx-ui-mcp-nginx-config-add-skips-config-directive-validation"},{"cve":"CVE-2026-84314","cvss":4,"epss":0.0033,"slug":"cve-2026-84314-nginx-ui-account-takeover-via-missing-requiresecuresession-on","title":"nginx-ui account takeover via missing 2FA on user password change","severity":"high","exploited":false,"published_at":"2026-10-12T21:17:21.753+00:00","url":"https://junglewise.ai/threats/cve-2026-84314-nginx-ui-account-takeover-via-missing-requiresecuresession-on"},{"cve":"CVE-2026-107813","cvss":8.8,"epss":0.0031,"slug":"cve-2026-107813-nginx-ui-incomplete-fix-of-the-api-cluster-router-was-not","title":"Nginx UI incomplete fix of authentication bypass in cluster router","severity":"high","exploited":false,"published_at":"2026-10-09T16:17:26.007+00:00","url":"https://junglewise.ai/threats/cve-2026-107813-nginx-ui-incomplete-fix-of-the-api-cluster-router-was-not"},{"cve":"CVE-2026-107810","cvss":8.1,"epss":0.0039,"slug":"cve-2026-107810-nginx-ui-backup-restore-follows-crafted-symlinks-into-the-live","title":"Nginx UI backup restore follows crafted symlinks into live configuration","severity":"high","exploited":false,"published_at":"2026-10-09T16:17:25.54+00:00","url":"https://junglewise.ai/threats/cve-2026-107810-nginx-ui-backup-restore-follows-crafted-symlinks-into-the-live"},{"cve":"CVE-2026-107809","cvss":8.8,"epss":0.0019,"slug":"cve-2026-107809-nginx-ui-authrequired-token-cookie-fallback-enables-csrf-against","title":"Nginx-UI cross-site request forgery via auth cookie fallback","severity":"high","exploited":false,"published_at":"2026-10-09T16:17:25.387+00:00","url":"https://junglewise.ai/threats/cve-2026-107809-nginx-ui-authrequired-token-cookie-fallback-enables-csrf-against"},{"cve":"CVE-2026-107807","cvss":8.8,"epss":0.003,"slug":"cve-2026-107807-nginx-ui-node-secret-credential-exposure-via-url-query-parameter","title":"Nginx UI node secret credential exposure via URL query parameter","severity":"high","exploited":false,"published_at":"2026-10-09T16:17:25.087+00:00","url":"https://junglewise.ai/threats/cve-2026-107807-nginx-ui-node-secret-credential-exposure-via-url-query-parameter"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":7},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Nginx UI","slug":"nginx-ui-nginx-ui","vendor":{"hub":true,"name":"Nginx UI","slug":"nginx-ui","url":"https://junglewise.ai/threats/vendors/nginx-ui"},"aliases":[],"category":"web-management","description":"Web-based user interface for managing and monitoring Nginx web server.","url":"https://junglewise.ai/threats/technologies/nginx-ui-nginx-ui"},"most_severe":[{"cve":"CVE-2026-84318","cvss":8.8,"epss":0.0062,"slug":"cve-2026-84318-nginx-ui-mcp-nginx-config-add-bypasses-directive-validation","title":"nginx-ui MCP nginx_config_add directive validation bypass","severity":"high","exploited":false,"published_at":"2026-10-12T21:17:22.36+00:00","url":"https://junglewise.ai/threats/cve-2026-84318-nginx-ui-mcp-nginx-config-add-bypasses-directive-validation"},{"cve":"CVE-2026-84317","cvss":8.8,"epss":0.0038,"slug":"cve-2026-84317-nginx-ui-mcp-nginx-config-add-skips-config-directive-validation","title":"Nginx UI nginx_config_add directive validation bypass","severity":"high","exploited":false,"published_at":"2026-10-12T21:17:22.213+00:00","url":"https://junglewise.ai/threats/cve-2026-84317-nginx-ui-mcp-nginx-config-add-skips-config-directive-validation"},{"cve":"CVE-2026-107813","cvss":8.8,"epss":0.0031,"slug":"cve-2026-107813-nginx-ui-incomplete-fix-of-the-api-cluster-router-was-not","title":"Nginx UI incomplete fix of authentication bypass in cluster router","severity":"high","exploited":false,"published_at":"2026-10-09T16:17:26.007+00:00","url":"https://junglewise.ai/threats/cve-2026-107813-nginx-ui-incomplete-fix-of-the-api-cluster-router-was-not"},{"cve":"CVE-2026-107807","cvss":8.8,"epss":0.003,"slug":"cve-2026-107807-nginx-ui-node-secret-credential-exposure-via-url-query-parameter","title":"Nginx UI node secret credential exposure via URL query parameter","severity":"high","exploited":false,"published_at":"2026-10-09T16:17:25.087+00:00","url":"https://junglewise.ai/threats/cve-2026-107807-nginx-ui-node-secret-credential-exposure-via-url-query-parameter"},{"cve":"CVE-2026-107809","cvss":8.8,"epss":0.0019,"slug":"cve-2026-107809-nginx-ui-authrequired-token-cookie-fallback-enables-csrf-against","title":"Nginx-UI cross-site request forgery via auth cookie fallback","severity":"high","exploited":false,"published_at":"2026-10-09T16:17:25.387+00:00","url":"https://junglewise.ai/threats/cve-2026-107809-nginx-ui-authrequired-token-cookie-fallback-enables-csrf-against"},{"cve":"CVE-2026-107810","cvss":8.1,"epss":0.0039,"slug":"cve-2026-107810-nginx-ui-backup-restore-follows-crafted-symlinks-into-the-live","title":"Nginx UI backup restore follows crafted symlinks into live configuration","severity":"high","exploited":false,"published_at":"2026-10-09T16:17:25.54+00:00","url":"https://junglewise.ai/threats/cve-2026-107810-nginx-ui-backup-restore-follows-crafted-symlinks-into-the-live"},{"cve":"CVE-2026-84360","cvss":8.1,"epss":0.0035,"slug":"cve-2026-84360-nginx-ui-otp-secure-session-step-up-can-be-bypassed-via-mcp","title":"Nginx UI OTP secure-session step-up bypass via MCP","severity":"high","exploited":false,"published_at":"2026-10-12T21:17:22.96+00:00","url":"https://junglewise.ai/threats/cve-2026-84360-nginx-ui-otp-secure-session-step-up-can-be-bypassed-via-mcp"},{"cve":"CVE-2026-84312","cvss":7.1,"epss":0.0018,"slug":"cve-2026-84312-nginx-ui-casdoor-sso-callback-uses-a-constant-state-parameter","title":"Nginx UI Casdoor SSO login CSRF via constant state parameter","severity":"high","exploited":false,"published_at":"2026-10-12T22:17:05.263+00:00","url":"https://junglewise.ai/threats/cve-2026-84312-nginx-ui-casdoor-sso-callback-uses-a-constant-state-parameter"},{"cve":"CVE-2026-84314","cvss":4,"epss":0.0033,"slug":"cve-2026-84314-nginx-ui-account-takeover-via-missing-requiresecuresession-on","title":"nginx-ui account takeover via missing 2FA on user password change","severity":"high","exploited":false,"published_at":"2026-10-12T21:17:21.753+00:00","url":"https://junglewise.ai/threats/cve-2026-84314-nginx-ui-account-takeover-via-missing-requiresecuresession-on"},{"cve":"CVE-2026-84320","cvss":6.3,"epss":0.0017,"slug":"cve-2026-84320-nginx-ui-auto-backup-name-allows-path-traversal-outside-validated","title":"Nginx UI auto backup path traversal in storage boundary","severity":"medium","exploited":false,"published_at":"2026-10-12T21:17:22.663+00:00","url":"https://junglewise.ai/threats/cve-2026-84320-nginx-ui-auto-backup-name-allows-path-traversal-outside-validated"}],"generated_at":"2026-11-12T03:07:00.164048+00:00"}