Tag

active-exploitation

Safeguard articles tagged "active-exploitation" — guides, analysis, and best practices for software supply chain and application security.

1 article

Vulnerability Analysis

MCPwn (CVE-2026-33032): One Missing Auth Check Turned nginx-ui's MCP Endpoint Into Unauthenticated RCE

nginx-ui added MCP support and split it across two HTTP routes. One route shipped without the auth middleware. The result is a CVSS 9.8 unauthenticated takeover, actively exploited, fixed with 27 characters of code.

May 4, 20269 min read