nginx security incidents and patch status · pwned.coffee

Skip to content

1 spill in 12 months for nginx

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

criticalpatched 9 Oct 2026 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite github.com/0xJacky/Nginx-UI (go) ## Summary An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`. This was validated on nginx-ui `2.3.11 2(523) 6c86e5a5` in the local Docker container `uozi/nginx-ui:latest`. ##… fixed in github.com/0xJacky/Nginx-UI 1.9.10-0.20260728074146-a467ed652591CVE-2026-1078065 sources

Follow nginx

RSS: /feed.xml?stack=nginx. JSON: /incidents.json?stack=nginx. Or add it to your usual for delivery.