Nginx Ui
Vendor:
First CVE: Jan 11, 2024 · Active for 2 years
23
Total CVEs
More Total CVEs than 95% of tracked products
11.5
Avg CVEs / Year
Higher CVE frequency than 97% of tracked products
8.5
Avg CVSS
Higher Avg CVSS than 75% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Nginx Ui over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 11, 2024
2 years ago
Most Recent CVE
May 12, 2026
74 days ago
CVE Severity & Scoring
Nginx Ui23 CVEs
22%
35%
43%
All CVEs352,708 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network23 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low22 (95.7%)
High1 (4.3%)
Unknown0 (0.0%)
User Interaction
None22 (95.7%)
Unknown0 (0.0%)
Required1 (4.3%)
Privileges Required
Low12 (52.2%)
High1 (4.3%)
None10 (43.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (23 CVEs).
23 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-33032CRITICAL Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and / | Mar 30, 2026 | 9.8 | 75 | NO | YES |
CVE-2026-27944CRITICAL Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys r | Mar 5, 2026 | 9.8 | 63 | NO | YES |
CVE-2024-49368CRITICAL Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it t | Oct 21, 2024 | 9.8 | 40 | NO | NO |
CVE-2026-42238CRITICAL Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated | May 4, 2026 | 9.8 | 38 | NO | NO |
CVE-2026-42222CRITICAL Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed | May 4, 2026 | 9.8 | 37 | NO | NO |
CVE-2026-42221CRITICAL Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator accou | May 4, 2026 | 9.8 | 37 | NO | NO |
CVE-2026-44015CRITICAL Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node poi | May 12, 2026 | 9.9 | 36 | NO | NO |
CVE-2026-33026CRITICAL Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives a | Mar 30, 2026 | 9.1 | 32 | NO | NO |
CVE-2026-33030CRITICAL Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any a | Mar 30, 2026 | 9.9 | 32 | NO | NO |
CVE-2026-34403HIGH Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin uncondition | Apr 20, 2026 | 8.1 | 31 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (23 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
2 CVEs
8.7% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (23 CVEs).
Media Mentions
Signals from CVEs in this product scope (23 CVEs).
Top CNAs Publishing CVEs For Nginx Ui
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.3.5 | 1 | 9.8 | 0.3% | 0 | 0 |
| 2.0.0 | 8 | 8.4 | 6.0% | 0 | 0 |
| 1.9.9-4 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.9.9-3 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.9.9-2 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.9.9-1 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.9.9 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.8.4 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.8.3 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.8.2 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.8.1 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.8.0 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.7.9 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.7.8 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.7.7 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.7.6 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.7.5 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.7.4 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.7.3 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.7.2 | 1 | 9.8 | 0.7% | 0 | 0 |