Skip to content
Threat Feed
Subscribe

Vendor

0xJacky

4 briefs RSS
high advisory

Unauthenticated Denial of Service via Temporary File Exhaustion in Nginx UI

An unauthenticated remote attacker can exploit CVE-2026-107805 in Nginx UI by sending malicious requests that trigger premature staging of large, unsigned request bodies, leading to disk space and I/O exhaustion.

Nginx UI +5 denial-of-service webserver availability credential-exposure authentication-bypass cve auth-bypass cve-2026-107813 +2
1r 9t 1c updated
high advisory

nginx-ui Race Condition Leads to Data Corruption and Potential RCE

The nginx-ui application is vulnerable to a race condition due to concurrent requests corrupting the app.ini configuration file, potentially leading to a persistent denial of service and a non-deterministic path to remote code execution.

nginx-ui race-condition denial-of-service remote-code-execution configuration-corruption
3r 2t
medium advisory

Nginx-UI Unauthenticated Initial Admin Claim Vulnerability

An unauthenticated network attacker can claim the initial administrator account on a fresh Nginx-UI instance during the first-run setup window by exploiting the publicly accessible /api/install endpoint.

Nginx-UI initial-access authentication-bypass
2r 1t
high advisory

Nginx-UI SSRF Vulnerability via Cluster Node Proxy

Nginx-UI version 2.3.4 and earlier is vulnerable to Server-Side Request Forgery (SSRF) allowing authenticated users to access internal services by manipulating cluster node configurations.

Nginx-UI ssrf web-application
2r 1t