NginxProxyManager CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM NginxProxyManager CVE published 2026-09-20

CVE-2026-93964

CVE-2026-93964 is a vulnerability detected in NginxProxyManager up to 2.15.1, impacting the internalCertificate.validate function in backend/internal/certificate.js. The vulnerability results in missing authentication and can be exploited remotely. The exploit is now public, but the endpoint only processes and echoes back the certificate submitted by the caller, with no stored data leaked. The real risk i [truncated]

HIGH NginxProxyManager CVE published 2026-06-08

CVE-2026-40519

CVE-2026-40519 is an authenticated remote code execution vulnerability in Nginx Proxy Manager versions 2.9.14 through 2.15.1. The vulnerability is caused by OS command injection in the setupCertbotPlugins() function in backend/setup.js, allowing attackers with certificates:manage permission to execute arbitrary commands by storing a malicious payload in the dns_provider_credentials field.