CVE-2026-84360
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSessi
CVSS
8.1
Alto
EPSS
0.3%
p27
KEV
—
Exploit Today
8
0-100
Publicado: 12 oct 2026 · Última mod.: 13 oct 2026 · CWE-288
0.3%EPSS · 30 días0.3%
2026-10-132026-10-23
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.
- github.comhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
- github.comhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
- github.comhttps://github.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4gwf-77xp
- github.comhttps://github.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4gwf-77xp
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-7985010.0 CRÍ33.1%
——10No description provided15hCVE-2026-7984410.0 CRÍ33.1%
——10No description provided15hCVE-2026-1147326.8 MED28.4%
——9Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.2dCVE-2026-963873.8 BAJ9.5%
——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.1dCVE-2026-963856.5 MED10.7%
——3Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.1dCVE-2026-84923—15.8%
——5Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.2d