en
NginxProxyManager is a global open-source project organization that develops software for managing Nginx reverse proxies. Its core project provides a web interface for proxy-host administration, TLS certificate handling, access control, and container-based deployment for self-hosted users and organizations.
As of 10/04/2026, NginxProxyManager recorded 3 security vulnerabilities in the last 90 days across 1 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, nginx-proxy-manager had the most security vulnerabilities in the NginxProxyManager ecosystem, with 3 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-102335Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config | Exploitation statusNot known exploited | FixYes | Affected productnginx-proxy-manager | Published09/28/2026 | SeverityHigh |
CVE-2026-102334Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection | Exploitation statusNot known exploited | FixYes | Affected productnginx-proxy-manager | Published09/28/2026 | SeverityCritical |
CVE-2026-93964NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication | Exploitation statusPublic exploit | FixNot confirmed | Affected productnginx-proxy-manager | Published09/20/2026 | SeverityMedium |
CVE-2026-40519Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins() | Exploitation statusNot known exploited | FixYes | Affected productnginx-proxy-manager | Published06/08/2026 | SeverityHigh |
CVE-2024-46256 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/27/2024 | SeverityCritical |
CVE-2024-46257 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/27/2024 | SeverityMedium |
CVE-2022-28379 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/03/2022 | SeverityMedium |
