rootpwn

high · CVSS v3 7.1 · CVSS v4 7.1

CVE-2026-102335

Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin use…

Description

Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.1
CVSS v4
7.1
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-102365

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.

View analysis

high

CVE-2026-97885

CloudClassroom-PHP-Project is vulnerable to a remote SQL injection via the fid parameter in updatefaculty.php. The flaw allows attackers to manipulate database queries and potentially exfiltrate or modify data. It is publicly disclosed and can be exploited without authentication.

View analysis

high

CVE-2026-101015

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

high

CVE-2026-102278

The brace-expansion library in Node.js can exhaust the native stack when processing deeply nested brace patterns, causing the Node.js process to terminate. This denial‑of‑service flaw affects versions prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11. It is a high‑severity vulnerability that can disrupt any application relying on brace expansion.

View analysis