Veille CVE

Semaine du 28 septembre au 4 octobre 2026

2 CVE

Critique 0 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « NginxProxyManager nginx-proxy-manager » ✕
  1. CVE-2026-102335 7.1 Élevée

    NginxProxyManager nginx-proxy-manager

    Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.

  2. CVE-2026-102334 7.4 Élevée

    NginxProxyManager nginx-proxy-manager

    Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.