CVE-2026-107806

Published 9 October 2026 · tracked since 10 October 2026

Description

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-108109 CRITICAL 9.1
• CVE-2026-108107 CRITICAL 9.8
• CVE-2026-108108 HIGH 7.1
• CVE-2026-108101 HIGH 7.5
• CVE-2026-107804 MEDIUM 5.3
• CVE-2026-107805 HIGH 7.5
• CVE-2026-105278 CRITICAL 9.8
• CVE-2026-104081 HIGH 8.1
• CVE-2026-94067 HIGH 8.1
• CVE-2026-94064 HIGH 8.8

→ Open the live CVE board · all tools