{"action":"Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260315015203-f61bcec547c0 or later.","affected":[{"fixed":"1.9.10-0.20260315015203-f61bcec547c0","introduced":"0"}],"component":"github.com/0xJacky/Nginx-UI","cve_ids":["CVE-2026-33026"],"ecosystem":"Go","epss":0.00334,"exploited":false,"fixed_versions":["1.9.10-0.20260315015203-f61bcec547c0"],"ghsa_id":"GHSA-fhh2-gg7w-gwpq","id":"tcs_01M5KF98TP6XQ6YJ43H04GEM5P","modified_at":"2026-07-06T19:45:08.896363138Z","published_at":"2026-03-30T16:23:34Z","references":["https://osv.dev/vulnerability/GHSA-fhh2-gg7w-gwpq","https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-fhh2-gg7w-gwpq","https://nvd.nist.gov/vuln/detail/CVE-2026-33026","https://github.com/0xJacky/nginx-ui/commit/f61bcec547c0f305e35348d6440ef156c1d5c3cb","https://github.com/0xJacky/nginx-ui","https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4","https://github.com/advisories/GHSA-g9w5-qffc-6762","https://pkg.go.dev/vuln/GO-2026-4903"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-fhh2-gg7w-gwpq","url":"https://osv.dev/vulnerability/GHSA-fhh2-gg7w-gwpq"},{"source":"nvd","source_id":"CVE-2026-33026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33026"}],"summary":"nginx-ui Backup Restore Allows Tampering with Encrypted Backups"}