nginxui nginx ui

Name: nginxui nginx ui
Brand: nginxui

productUS

cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

8critical9high3medium0low

updated 2026-10-28

vulnerabilities (32)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-33032US	—OT elevated	35.3% (98th)	Exploit	no fix	2026-03-30	≤ 2.3.5
CVE-2024-49368US	critical9.8	27.7% (98th)	Exploit	no fix	2024-10-21	2 versions
CVE-2026-27944US	—OT elevated	22.9% (98th)	Exploit	2.3.3	2026-03-05	< 2.3.3
CVE-2024-22198US	high8.8	4.06% (91st)	Exploit	2.0.0	2024-01-11	2 versions
CVE-2026-42221US	critical9.8OT high	1.34% (71st)	Exploit	2.3.8	2026-05-04	2.0.0 → 2.3.8
CVE-2026-107806US	high7.2	0.57% (47th)	Exploit	2.5.0	2026-10-09	2.3.8 → 2.5.0
CVE-2024-22197US	high8.8	1.54% (75th)	—	2.0.0	2024-01-11	2 versions
CVE-2024-23828US	high8.8	1.05% (64th)	—	2.0.0	2024-01-29	2 versions
CVE-2026-33029US	medium6.5	0.98% (62nd)	—	2.3.4	2026-03-30	< 2.3.4
CVE-2026-42238US	critical9.8	0.97% (62nd)	—	2.3.8	2026-05-04	< 2.3.8
CVE-2024-23827US	critical9.8	0.70% (53rd)	—	no fix	2024-01-29	42 versions
CVE-2024-49367US	high7.5OT elevated	0.64% (50th)	—	no fix	2024-10-21	2 versions
CVE-2024-49366US	high7.5	0.60% (48th)	—	no fix	2024-10-21	2 versions
CVE-2024-22196US	medium6.5	0.58% (48th)	—	2.0.0	2024-01-11	2 versions
CVE-2026-33028US	high7.5	0.55% (46th)	—	2.3.4	2026-03-30	< 2.3.4
CVE-2026-107805US	—	0.47% (40th)	—	2.6.0	2026-10-09	2.5.0 → 2.6.0
CVE-2026-107810US	—	0.45% (38th)	—	2.5.0	2026-10-09	2.0.0 → 2.5.0
CVE-2026-107811US	—OT elevated	0.43% (38th)	—	2.5.0	2026-10-09	2.0.0 → 2.5.0
CVE-2026-33027US	medium6.5	0.41% (35th)	—	2.3.4	2026-03-30	< 2.3.4
CVE-2026-107808US	—	0.41% (35th)	—	2.5.0	2026-10-09	2.0.0 → 2.5.0
CVE-2026-42222US	critical9.8OT elevated	0.34% (27th)	—	no fix	2026-05-04	= 2.3.5
CVE-2026-33026US	critical9.1OT elevated	0.33% (27th)	—	2.3.4	2026-03-30	< 2.3.4
CVE-2026-44015US	critical9.9	0.32% (25th)	—	no fix	2026-05-12	≤ 2.3.4
CVE-2026-107813US	—OT elevated	0.30% (23rd)	—	2.5.0	2026-10-09	2.0.0 → 2.5.0
CVE-2026-42220US	—OT elevated	0.30% (22nd)	—	2.3.8	2026-05-04	< 2.3.8
CVE-2026-107807US	—OT elevated	0.30% (22nd)	—	2.5.0	2026-10-09	2.0.0 → 2.5.0
CVE-2026-42223US	—	0.29% (22nd)	—	2.3.8	2026-05-04	< 2.3.8
CVE-2026-33030US	critical9.9	0.29% (21st)	—	no fix	2026-03-30	≤ 2.3.3
CVE-2026-33031US	high8.1OT elevated	0.27% (20th)	—	2.3.4	2026-04-20	< 2.3.4
CVE-2026-107809US	—	0.23% (13th)	—	2.5.0	2026-10-09	2.0.0 → 2.5.0
CVE-2026-34403US	high8.1	0.18% (7th)	—	2.3.5	2026-04-20	< 2.3.5
CVE-2026-107812US	—OT elevated	0.18% (7th)	—	2.5.0	2026-10-09	2.0.0 → 2.5.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-306Missing Authentication for Critical Function4 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor3 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-862Missing Authorization3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-284Improper Access Control2 CVEs
CWE-312Cleartext Storage of Sensitive Information2 CVEs
CWE-352Cross-Site Request Forgery (CSRF)2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE32 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan