Vulnerabilities in 0xJacky
44 resultsCVE-2026-34403MEDIUMNginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpointsEPSS 0.2%CVE-2026-107812HIGHNginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITMEPSS 0.2%CVE-2026-84312HIGHNginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)EPSS 0.2%CVE-2026-84320MEDIUMNginx UI: Auto backup name allows path traversal outside validated storage pathEPSS 0.2%