CVE-2026-102334

Published 28 September 2026 · tracked since 29 September 2026

Description

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa t

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-102264 LOW 3.5
• CVE-2026-102263 MEDIUM 4.7
• CVE-2026-102414 LOW 3.7
• CVE-2026-102422 HIGH 8.1
• CVE-2026-102247 MEDIUM 6.8
• CVE-2026-96326 HIGH 7.2
• CVE-2026-101858 MEDIUM 4.7
• CVE-2026-101859 MEDIUM 5.4
• CVE-2026-101860 HIGH 8.8
• CVE-2026-101280 HIGH 7.3

→ Open the live CVE board · all tools