0xJacky vulnerabilities
44 published CVEs name 0xJacky among the affected products.
- 44Published CVEs44 of them scored
- 36Last 12 monthspublished in the last year
- 6Critical29 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-84312
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
0xJacky · nginx-ui
High7.1 - CVE-2026-84360
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
0xJacky · nginx-ui
High8.1 - CVE-2026-84316
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
0xJacky · nginx-ui
High8.8 - CVE-2026-84319
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
0xJacky · nginx-ui
High8.3 - CVE-2026-84317
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
0xJacky · nginx-ui
High8.8 - CVE-2026-84313
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
0xJacky · nginx-ui
High8.8 - CVE-2026-84321
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
0xJacky · nginx-ui
Medium5.4 - CVE-2026-84314
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
0xJacky · nginx-ui
High8.7 - CVE-2026-84320
Nginx UI: Auto backup name allows path traversal outside validated storage path
0xJacky · nginx-ui
Medium6.3 - CVE-2026-84318
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
0xJacky · nginx-ui
High8.8