CVEs we hold for Nagios

Records whose assigning authority named Nagios as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-48554Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro SubstitutionNagios XI

CVE-2026-48553Nagios Core / XI Authenticated RCE via Custom-Variable Macro InjectionNagios XI

CVE-2026-48552Nagios Core / XI DOM-based XSS via jsonquery.jsNagios XI

CVE-2026-48551Nagios Core / XI CSRF Protection Bypass via Double-Submit CookieNagios XI

CVE-2026-48550Nagios Core / XI cmd.cgi Reflected XSS via NagFormId ParameterNagios XI

CVE-2026-48549Nagios Core / XI CSRF via cmd.cgi Double-Submit CookieNagios XI

CVE-2026-48548Nagios Core CSRF via cmd.cgiNagios Core

CVE-2026-2043Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution VulnerabilityNagios Host

CVE-2026-2042Nagios Host monitoringwizard Command Injection Remote Code Execution VulnerabilityNagios Host

CVE-2026-2041Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution VulnerabilityNagios Host

CVE-2025-44824no title heldNagios Log Server

CVE-2025-44823no title heldNagios Log Server

CVE-2025-34323Nagios Log Server < 2026R1.0.1 Local Privilege Escalation via Writable Scripts and Sudo RulesNagios Log Server

CVE-2025-34322Nagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language QueriesNagios Log Server

CVE-2025-34298Nagios Log Server < 2024R1.3.2 Set Email Privilege EscalationNagios Log Server

CVE-2025-34288Nagios XI Privilege Escalation via Writable PHP Include Executed with SudoNagios XI

CVE-2025-34287Nagios XI < 2024R2 Privilege Escalation via process_perfdata.plNagios XI

CVE-2025-34286Nagios XI < 2026R1 RCE via Run Check Command in CCMNagios XI

CVE-2025-34284Nagios XI < 2024R2 Authenticated Command Injection via WinRM PluginNagios XI

CVE-2025-34283Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune ThemesNagios XI

CVE-2025-34280Nagios Network Analyzer < 2024R2.0.1 RCE in LDAP Certificate Removal FunctionNagios Network Analyzer

CVE-2025-34278Nagios Network Analyzer < 2024R1 Source Groups / Percentile Calculator Menu Stored XSSNagios Network Analyzer

CVE-2025-34277Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard IDNagios Log Server

CVE-2025-34274Nagios Log Server < 2024R2.0.3 Logstash Process Root PrivilegesNagios Log Server

CVE-2025-34273Nagios Log Server < 2024R2.0.3 Non-Admin Dashboard DeletionNagios Log Server

CVE-2025-34272Nagios Log Server < 2024R2.0.3 Non-Empty Default Dashboard FallbackNagios Log Server

CVE-2025-34271Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over PlaintextNagios Log Server

CVE-2025-34270Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not ObfuscatedNagios Log Server

CVE-2025-34227Nagios XI < 2026R1 Configuration Wizard Authenticated Command InjectionNagios XI

CVE-2025-34135Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit FilesNagios XI

CVE-2025-34134Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)Nagios XI

CVE-2024-58273Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to RootNagios Log Server

CVE-2024-14009Nagios XI < 2024R1.0.1 Privilege Escalation via System ProfileNagios XI

CVE-2024-14008Nagios XI < 2024R1.3.2 RCE via WinRM Configuration WizardNagios XI

CVE-2024-14006Nagios XI < 2024R1.2.2 Host Header InjectionNagios XI

CVE-2024-14005Nagios XI < 2024R1.2 Command Injection via Docker WizardNagios XI

CVE-2024-14004Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)Nagios XI

CVE-2024-14003Nagios XI < 2024R1.2 RCE via NRDP Server PluginsNagios XI

CVE-2024-14002Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVisNagios XI

CVE-2024-14001Nagios XI < 2024R1.1.3 XSS via Executive Summary ReportNagios XI

CVE-2024-14000Nagios XI < 2024R1.1.3 XSS via Capacity Planning ReportNagios XI

CVE-2024-13999Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information DisclosureNagios XI

CVE-2024-13998Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information DisclosureNagios XI

CVE-2024-13997Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on HostNagios XI

CVE-2024-13996Nagios XI < 2024R1.1.3 Session Not Invalidated After Password ChangeNagios XI

CVE-2024-13995Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information DisclosureNagios XI

CVE-2024-13994Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing AuthorizationNagios XI

CVE-2024-13993Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older BrowsersNagios XI

CVE-2024-13992Nagios XI < 2024R1.1 XSS via Missing Page / 404Nagios XI

CVE-2024-13986Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCENagios XI

CVE-2023-7323Nagios Log Server < 2024R1 XSS via Create User FunctionNagios Log Server

CVE-2023-7322Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API AccessNagios Log Server

CVE-2023-7321Nagios Log Server < 2.1.14 XSS via Snapshots PageNagios Log Server

CVE-2023-7319Nagios Network Analyzer < 2024R1 XSS via Percentile Calculator MenuNagios Network Analyzer

CVE-2023-7318Nagios XI < 2024R1.0.2 XSS via Core Command ExpansionNagios XI

CVE-2023-7317Nagios XI < 2024R1 Web SSH Terminal Missing Access ControlNagios XI

CVE-2023-7316Nagios XI < 2024R1 XSS via Graph ExplorerNagios XI

CVE-2023-7315Nagios XI < 5.11.3 XSS via Graph ExplorerNagios XI

CVE-2023-7314Nagios XI < 5.11.3 XSS via Bandwidth ReportNagios XI

CVE-2023-7313Nagios XI < 5.11.3 XSS via Bulk ModificationsNagios XI

CVE-2023-7312Nagios Fusion < 4.2.0 Email Settings Stored XSS via SMTP/sendmailNagios Fusion

CVE-2023-53690Nagios Fusion < 4.2.0 LDAP/AD Integration Stored XSSNagios Fusion

CVE-2023-53689Nagios Fusion < 4.2.0 License Information Reflected XSSNagios Fusion

CVE-2023-53688Nagios XI < 5.11.3 XSS & CSRF via Hypermap ReplayNagios XI

CVE-2023-24035no title heldNagios XI

CVE-2023-24034no title heldNagios XI

CVE-2022-50588Nagios XI < 5.8.9 Stored XSS in Update CheckingNagios XI

CVE-2022-50587Nagios XI < 5.8.9 Stored XSS via Command Names in Apply Config Error TextNagios XI

CVE-2022-50586Nagios XI < 5.8.9 Stored XSS via BPI Info URLNagios XI

CVE-2022-50585Nagios XI < 5.8.9 Core Config Manager (CCM) XSS via Audit Log Page Search InputNagios XI

CVE-2022-50584Nagios XI < 5.8.8 Core Config Manager (CCM) XSS via Search & Deletion FlowsNagios XI

CVE-2021-47700Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary DirectoryNagios XI

CVE-2021-47699Nagios XI < 5.8.7 XSS in Audit Log via Send to NLS FormNagios XI

CVE-2021-47698Nagios XI < 5.8.7 XSS in Core UI Views URL handlingNagios XI

CVE-2021-47697Nagios XI < 5.8.0 XSS via Views URL HandlingNagios XI

CVE-2021-47696Nagios XI < 5.8.0 XSS via BPI Config ID HandlingNagios XI

CVE-2021-47695Nagios XI < 5.8.0 XSS via My Tools PageNagios XI

CVE-2021-47694Nagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test CommandNagios XI

CVE-2021-47693Nagios XI < 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search TextNagios XI

CVE-2021-47691Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Services PageNagios XI

CVE-2021-47690Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Overlay ModalsNagios XI

CVE-2021-47689Nagios XI < 5.8.0 Core Config Manager (CCM) XSS via Templates PagesNagios XI

CVE-2021-4285Nagios NCPA tail.html cross site scriptingNagios NCPA

CVE-2021-33179no title heldNagios XI

CVE-2021-33177no title heldNagios XI

CVE-2020-7206no title heldn/a nagios-plugins-ilo

CVE-2020-5796no title heldn/a Nagios XI

CVE-2020-5792no title heldn/a Nagios XI

CVE-2020-5791no title heldn/a Nagios XI

CVE-2020-5790no title heldn/a Nagios XI

CVE-2020-36869Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit PageNagios XI

CVE-2020-36868Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh ScriptNagios XI

CVE-2020-36867Nagios XI < 5.7.3 Command Injection in Report PDF DownloadNagios XI

CVE-2020-36866Nagios XI < 5.7.3 XSS via Manage Users in Admin InterfaceNagios XI

CVE-2020-36865Nagios XI < 5.7.2 XSS via BPI Config ManagementNagios XI

CVE-2020-36864Nagios XI < 5.7.2 XSS via Dashboard Background Color SettingNagios XI

CVE-2020-36863Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import DirectoryNagios XI

CVE-2020-36862Nagios XI < 5.6.11 Unauthenticated XSS and SSRF via HighchartsNagios XI

CVE-2020-36861Nagios XI < 5.7.5 Core Config Manager (CCM) XSS via Overlay Rendering and Notification/Check Period PagesNagios XI

CVE-2020-36860Nagios XI < 5.7.4 Core Config Manager (CCM) XSS via Object Edit PagesNagios XI

CVE-2020-36859Nagios XI < 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit PagesNagios XI

CVE-2020-36858Nagios Log Server < 2.1.6 XSS via Create User, Edit User, & Manage Host Lists PagesNagios Log Server

CVE-2020-36857Nagios XI < 5.6.14 Authenticated SQL Injection via SNMP Trap Interface PageNagios XI

CVE-2020-36856Nagios XI < 5.6.14 Authenticated RCE command_test.php via addressNagios XI

CVE-2018-25123Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing ComponentNagios XI

CVE-2018-25122Nagios XI < 5.4.13 Component Download Page RCENagios XI

CVE-2018-25121Nagios XI < 5.4.13 XSS via Views PageNagios XI

CVE-2018-25119Nagios Fusion < 4.1.5 XSS via fusionwindow ParameterNagios Fusion

CVE-2018-15714no title heldNagios XI

CVE-2018-15713no title heldNagios XI

CVE-2018-15712no title heldNagios XI

CVE-2018-15711no title heldNagios XI

CVE-2018-15710no title heldNagios XI

CVE-2018-15709no title heldNagios XI

CVE-2018-15708no title heldNagios XI

CVE-2017-20209Nagios Fusion < 4.0.1 XSS via Users/Servers PageNagios Fusion

CVE-2016-8641no title heldnagios

CVE-2016-15053Nagios XI < 5.2.4 XSS via “My Reports” ListingNagios XI

CVE-2016-15052Nagios XI < 5.2.4 XSS via Menu SystemNagios XI

CVE-2016-15051Nagios XI < 5.2.4 XSS via Report startdate/enddate FieldsNagios XI

CVE-2016-15050Nagios XI < 5.2.4 SQL Injection in Notification SearchNagios XI

CVE-2016-15049Nagios Log Server < 1.4.2 Dashboards Logs Table XSSNagios Log Server

CVE-2013-10074Nagios XI < 2012R2.6 XSS via Tools MenuNagios XI

CVE-2013-10073Nagios XI < 2012R1.6 Auto-Discovery Shell Command InjectionNagios XI

CVE-2013-10072Nagios XI < 2012R1.6 Auto-Discovery Missing AuthorizationNagios XI

CVE-2013-10071Nagios XI < 2012R1.6 Reflected XSS via Dashlet AJAX Load FunctionalityNagios XI

CVE-2012-10063Nagios XI < 2012R1.3 Authenticated SQL Injection in Legacy CCMNagios XI

CVE-2012-10029Nagios XI Network Monitor Graph Explorer Component < 1.3 Authenticated Command InjectionNagios XI Graph Explorer

CVE-2011-10040Nagios XI < 2011R1.9 XSS via Status/Report Page Link FunctionsNagios XI

CVE-2011-10039Nagios XI < 2011R1.9 XSS via Alert Heatmap Report & “My Reports” ListingNagios XI

CVE-2011-10038Nagios XI < 2011R1.9 XSS via Recurring Downtime ScriptNagios XI

CVE-2011-10037Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting PermalinksNagios XI

CVE-2011-10036Nagios XI < 2011R1.9 XSS via backend_url JavaScript Link HandlerNagios XI

CVE-2011-10035Nagios XI < 2011R1.9 Race Conditions in Crontab Install Scripts LPENagios XI

134 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.