0
Vendor security profile
0xJacky
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs21
Critical1
CISA KEV0
Public exploit13
Patch rate%0
Avg. CVSS8.0
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
0
21
CVE KEV
CVE severity distribution
21toplam CVE
Critical1 (5%)
High17 (81%)
Medium3 (14%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%62
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
21Unknown
Latest vulnerabilities
7.1
CVE-2026-84312
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
0
Patch status unknownEPSS %0
8.1
CVE-2026-84360
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
0
Patch status unknownEPSS %0
8.8
CVE-2026-84316
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
0
Patch status unknownEPSS %0
8.3
CVE-2026-84319
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
0
Patch status unknownEPSS %0
8.8
CVE-2026-84317
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
0
Patch status unknownEPSS %0
8.8
CVE-2026-84313
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
0
Patch status unknownEPSS %0
5.4
CVE-2026-84321
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
0
Patch status unknownEPSS %0
8.7
CVE-2026-84314
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
0
Patch status unknownEPSS %0
6.3
CVE-2026-84320
Nginx UI: Auto backup name allows path traversal outside validated storage path
0
Patch status unknownEPSS %0
8.8
CVE-2026-84318
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
0
Patch status unknownEPSS %1