Read the docs

nezhahq

Records30All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9

Exploited now

nezhahq records in CISA KEV

No nezhahq vulnerabilities are listed in CISA KEV.

Records

30 records

TI-2026-75131 CVE-2026-111384

Memory exhaustion in Nezha file manager WebSocket endpoint

Priority MEDIUM 64

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00358 Published 2026-10-16 Fixed in 2.3.15 CWE-770
TI-2026-75130 CVE-2026-111383

Nezha WebSocket transfer endpoint flaw enables denial of service

Priority MEDIUM 64

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00358 Published 2026-10-16 Fixed in 2.3.15 CWE-770
TI-2026-65118 CVE-2026-101085 · GHSA-5j6x-8f94-88gc

Nezha before 2.3.8 Denial of Service via Alert Rule

Priority MEDIUM 64

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00301 Published 2026-09-27 Fixed in 2.3.8 CWE-197
TI-2026-36564 CVE-2026-49397 · GHSA-vrmh-5mmx-hjwx

Information disclosure in nezhahq nezha

Priority MEDIUM 63

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00305 Published 2026-06-12 Fixed in 2.0.14 CWE-200
TI-2026-74064 CVE-2026-100394 · GHSA-qjpp-gffx-2wm9

Race condition in Nezha dashboard lets a member crash the process

Priority MEDIUM 62

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00498 Published 2026-10-14 Fixed in 2.2.11, 0.0.0-20260721131105-c893aa57867d CWE-362
TI-2026-75132 CVE-2026-111385

Host header injection in Nezha MCP transfer tools

Priority MEDIUM 61

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00238 Published 2026-10-16 Fixed in 2.3.15 CWE-601
TI-2026-67487 CVE-2026-105112 · GHSA-xjpm-v974-vhq4

Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints

Priority MEDIUM 60

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00218 Published 2026-10-03 Fixed in 2.3.13 CWE-362
TI-2026-75133 CVE-2026-111386

Cross-tenant server ID enumeration in Nezha via getServerConfig

Priority MEDIUM 57

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0021 Published 2026-10-16 Fixed in 2.3.15 CWE-204
TI-2026-75134 CVE-2026-111387

Information disclosure in Nezha DDNS list endpoint exposes webhook tokens

Priority LOW 31

Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00264 Published 2026-10-16 Fixed in 2.3.15 CWE-212
Load more
Open these records in search →