Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
206 results · page 1 of 5
Sep 14, 2026An issue was discovered in Nagios XI before 5.9.3.CVE-2023-24035 · Other software · Nagios · reported by MITRELow 3.5
An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3.CVE-2023-24034 · Other software · Nagios · reported by MITRELow 3.1
An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi.CVE-2026-48549 · Other software · Nagios Enterprises, LLC. · reported by VulnCheckMedium 6.9
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute Nagios commands as a currently authenticated user.
- Product
- Nagios Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitutCVE-2026-48554 · Other software · Nagios Enterprises, LLC. · reported by VulnCheckHigh 7.7
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.
- Product
- Nagios Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the NaCVE-2026-48553 · Other software · Nagios Enterprises, LLC. · reported by VulnCheckHigh 7.7
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is referenced in a shell-executed command line, an authenticated attacker with NRDP access can inject OS commands through the macro value. Exploitation requires a non-default configuration in which a custom variable is defined and referenced in a shell-executed command.
- Product
- Nagios Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js.CVE-2026-48552 · Other software · Nagios Enterprises, LLC. · reported by VulnCheckMedium 5.1
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browser.
- Product
- Nagios Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie.CVE-2026-48551 · Other software · Nagios Enterprises, LLC. · reported by VulnCheckMedium 6.1
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.
- Product
- Nagios Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter.CVE-2026-48550 · Other software · Nagios Enterprises, LLC. · reported by VulnCheckMedium 5.1
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.
- Product
- Nagios Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.CVE-2025-67255 · Other software · Nagios · reported by MITREHigh 8.8
In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.CVE-2025-67254 · Other software · Nagios · reported by MITREHigh 7.5
NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and application file perCVE-2025-34288 · Other software · Nagios Enterprises · reported by VulnCheckHigh 8.6
Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and application file permissions. A user‑accessible maintenance script may be executed as root via sudo and includes an application file that is writable by a lower‑privileged user. A local attacker with access to the application account can modify this file to introduce malicious code, which is then executed with elevated privileges when the script is run. Successful exploitation results in arbitrary code execution as the root user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Nov 3, 2025Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to auCVE-2024-13998 · Other software · Nagios · reported by VulnCheckMedium 6
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts. CVE-2024-13995 addresses a similar vulnerability with a potentially incomplete fix for the underlying problem in earlier versions.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feCVE-2024-13997 · Other software · Nagios · reported by VulnCheckCritical 9.4
Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the underlying XI host. By abusing the migration workflow, an admin-level attacker could execute actions outside the intended security scope of the application, resulting in full control of the operating system.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string())CVE-2021-47698 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string()). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 31, 2025Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link froCVE-2024-13992 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied input, allowing an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI domain.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-dCVE-2025-34287 · Other software · Nagios · reported by VulnCheckHigh 8.4
Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-data. Because the file was writable by www-data, an attacker with web server privileges could modify its contents, leading to arbitrary code execution as the nagios user when the script is next run. This improper ownership and permission configuration enables local privilege escalation.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command.CVE-2025-34286 · Other software · Nagios · reported by VulnCheckCritical 9.4
Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/escaping of parameters used to build backend command lines allows an authenticated administrator to inject shell metacharacters that are executed on the server. Successful exploitation results in arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to gain control of the underlying host operating system.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin.CVE-2025-34284 · Other software · Nagios · reported by VulnCheckCritical 9.4
Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to modify configuration, exfiltrate data, disrupt monitoring operations, or execute commands on the underlying host operating system.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes.CVE-2025-34283 · Other software · Nagios · reported by VulnCheckHigh 7.1
Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive.CVE-2025-34135 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component.CVE-2025-34134 · Other software · Nagios · reported by VulnCheckCritical 9.4
Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validation and sanitization of administrator-controlled BPI configuration parameters (notably bpi_logfile and bpi_configfile) allow an authenticated administrative user to cause the product to create or overwrite files within the webroot and subsequently edit them via the BPI configuration editor. When such files carry executable extensions and are served by the web application, arbitrary code may be executed in the context of the web application user. Successful exploitation results in arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to gain further control of the underlying host operating system.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component.CVE-2024-14009 · Other software · Nagios · reported by VulnCheckCritical 9.4
Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnostic/configuration capability. Due to improper access controls and unsafe handling of exported/imported profile data and operations, an authenticated administrator could exploit this vulnerability to execute actions on the underlying XI host outside the application's security scope. Successful exploitation may allow an administrator to obtain root privileges on the XI server.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard.CVE-2024-14008 · Other software · Nagios · reported by VulnCheckCritical 9.4
Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability.CVE-2024-14006 · Other software · Nagios · reported by VulnCheckHigh 8.8
Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard.CVE-2024-14005 · Other software · Nagios · reported by VulnCheckCritical 9.4
Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient validation of user-supplied input in the wizard allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf).CVE-2024-14004 · Other software · Nagios · reported by VulnCheckHigh 8.7
Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf). An authenticated user could manipulate NagVis configuration data or leverage insufficiently validated configuration settings to obtain elevated privileges on the Nagios XI system.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins.CVE-2024-14003 · Other software · Nagios · reported by VulnCheckCritical 9.4
Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary commands on the underlying host in the context of the web/Nagios service.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration.CVE-2024-14002 · Other software · Nagios · reported by VulnCheckHigh 7.1
Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Executive Summary Report component.CVE-2024-14001 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Executive Summary Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Capacity Planning Report component.CVE-2024-14000 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Capacity Planning Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticateCVE-2024-13999 · Other software · Nagios · reported by VulnCheckHigh 7.3
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromise of network-integrated systems.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed.CVE-2024-13996 · Other software · Nagios · reported by VulnCheckCritical 9.2
Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credential update. This insufficient session expiration could allow continued unauthorized access to user data and actions even after a password change.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed pasCVE-2024-13995 · Other software · Nagios · reported by VulnCheckHigh 7.1
Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled.CVE-2024-13994 · Other software · Nagios · reported by VulnCheckHigh 8.7
Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization. This can lead to unauthorized account creation, privilege escalation, or full compromise of the Nagios XI web interface depending on the target account.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers.CVE-2024-13993 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI origin. The issue is observable under legacy browser behaviors; modern browsers may mitigate some vectors.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to < 2024R1.0.2 are vulnerable to cross-site scripting (XSS) via the Nagios Core Command Expansion page.CVE-2023-7318 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to < 2024R1.0.2 are vulnerable to cross-site scripting (XSS) via the Nagios Core Command Expansion page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal.CVE-2023-7317 · Other software · Nagios · reported by VulnCheckCritical 9.4
Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of sensitive information.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component.CVE-2023-7316 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component.CVE-2023-7315 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component.CVE-2023-7314 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool.CVE-2023-7313 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component.CVE-2023-53688 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component. An attacker can submit crafted input that is not properly validated or escaped, allowing injection of malicious script that executes in the context of a victim's browser (XSS). Additionally, the component does not enforce sufficient anti-CSRF protections on state-changing operations, enabling an attacker to induce authenticated users to perform unwanted actions.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the update checking feature.CVE-2022-50588 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the update checking feature. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) via the Apply Configuration error text.CVE-2022-50587 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) via the Apply Configuration error text. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the BPI component via the info URL field.CVE-2022-50586 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the BPI component via the info URL field. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.7 / Nagios XI 5.8.9 contains a cross-site scripting (XSS) vulnerability via the Audit Log pCVE-2022-50585 · Other software · Nagios · reported by VulnCheckMedium 5.1
The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.7 / Nagios XI 5.8.9 contains a cross-site scripting (XSS) vulnerability via the Audit Log page search input. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.6 / Nagios XI 5.8.8 contains a cross-site scripting (XSS) vulnerability via the search and CVE-2022-50584 · Other software · Nagios · reported by VulnCheckMedium 5.1
The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.6 / Nagios XI 5.8.8 contains a cross-site scripting (XSS) vulnerability via the search and deletion interfaces. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025Nagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user.CVE-2021-47700 · Other software · Nagios · reported by VulnCheckHigh 8.5
Nagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user. Local or co-hosted processes could read/overwrite export artifacts or manipulate paths, risking disclosure or tampering and potential code execution depending on deployment.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025Nagios XI versions prior to 5.8.7 are vulnerable to cross-site scripting (XSS) via the Audit Log page’s Send to NLS form.CVE-2021-47699 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.8.7 are vulnerable to cross-site scripting (XSS) via the Audit Log page’s Send to NLS form. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via the Views feature URL handling.CVE-2021-47697 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via the Views feature URL handling. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.