Vulnerabilities

TI-2026-44107 CVE-2026-61552

Icinga 2 DSL Injection via Unescaped Import Template Name

LOW 35

Icinga 2 is an open source monitoring system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00901 Published 2026-09-18 Fixed in 2.14.9, 2.15.4 +1 CWE-94

TI-2026-44106 CVE-2026-61551

Icinga 2: Stack overflow via deeply nested JSON objects

MEDIUM 45

Icinga 2 is an open source monitoring system.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00941 Published 2026-09-18 Fixed in 2.14.9, 2.15.4 +1 CWE-674

TI-2026-44105 CVE-2026-61550

Icinga 2: Improper access control for JSON-RPC update certificate messages

MEDIUM 50

Icinga 2 is an open source monitoring system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00674 Published 2026-09-18 Fixed in 2.14.9, 2.15.4 +1 CWE-862

TI-2026-30545 CVE-2026-42224 · GHSA-55wf-5m3q-6jjf

ipl/web is vulnerable to reflected XSS by malformed search requests

LOW 35

ipl/web is a set of common web components for php projects.

CVSS 3.1HIGH 7.6 Network High privileges User interaction EPSS 0.00259 Published 2026-05-08 Fixed in 0.13.1, 0.10.3 CWE-79

TI-2026-19681 CVE-2026-24414

Icinga for Windows certificate can have too-open permissions

LOW 29

The Icinga PowerShell Framework provides configuration and check possibilities to ensure integration and monitoring of Windows environments.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00101 Published 2026-01-29 Fixed in 1.11.2, 1.12.4 +1 CWE-276

TI-2026-19680 CVE-2026-24413

Icinga has insecure permission of %ProgramData%\icinga2\var on Windows

LOW 29

Icinga 2 is an open source monitoring system.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00078 Published 2026-01-29 Fixed in 2.13.14, 2.14.8 +1 CWE-276

TI-2025-38259 CVE-2025-61909

Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user

LOW 18

Icinga 2 is an open source monitoring system.

CVSS 4.0MEDIUM 4.0 Local High privileges No interaction EPSS 0.00216 Published 2025-10-16 Fixed in 2.13.13, 2.14.7 +1 CWE-250

TI-2025-38258 CVE-2025-61908

Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference

LOW 32

Icinga 2 is an open source monitoring system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00551 Published 2025-10-16 Fixed in 2.13.13, 2.14.7 +1 CWE-476

TI-2025-38257 CVE-2025-61907

Icinga 2 API users could access restricted values in filter expressions

LOW 31

Icinga 2 is an open source monitoring system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00413 Published 2025-10-16 Fixed in 2.15.1, 2.14.7 +1 CWE-200

TI-2025-38182 CVE-2025-61789

Icinga DB Web hidden/protected custom variables are prone to filter enumeration

LOW 29

Icinga DB Web provides a graphical interface for Icinga monitoring.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00371 Published 2025-10-16 Fixed in 1.1.4, 1.2.3 CWE-204

TI-2025-33732 CVE-2025-53840

Icinga DB Web Exposure of Sensitive Information to an Unauthorized Actor vulnerability

LOW 12

Icinga DB Web provides a graphical interface for Icinga monitoring.

CVSS 3.1LOW 2.4 Network High privileges User interaction EPSS 0.00297 Published 2025-07-16 Fixed in 1.2.2 CWE-200

TI-2025-30428 CVE-2025-48057

Icinga 2 certificate renewal might incorrectly renew an invalid certificate

MEDIUM 48

Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00462 Published 2025-05-27 Fixed in 2.14.6, 2.13.12 +1 CWE-296

TI-2025-21503 CVE-2025-30164

Icinga Web 2 has open redirect on login page

LOW 27

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00269 Published 2025-03-26 Fixed in 2.11.5, 2.12.3 CWE-601

TI-2025-20418 CVE-2025-27609

Icinga Web 2 Vulnerable to Reflected XSS

LOW 9

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.

CVSS 4.0LOW 1.1 Local No auth User interaction EPSS 0.00253 Published 2025-03-26 Fixed in 2.11.5, 2.12.3 CWE-79

TI-2025-20241 CVE-2025-27406

Icinga Reporting Stored XSS leads to SSRF

LOW 36

Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00328 Published 2025-03-26 Fixed in 1.0.3 CWE-79

TI-2025-20240 CVE-2025-27405

Icinga Web 2 has XSS in embedded content

LOW 36

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00332 Published 2025-03-26 Fixed in 2.11.5, 2.12.3 CWE-79

TI-2025-20239 CVE-2025-27404

Icinga Web 2 DOM-based XSS vulnerability

LOW 37

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.

CVSS 3.1HIGH 7.7 Network High privileges User interaction EPSS 0.00607 Published 2025-03-26 Fixed in 2.11.5, 2.12.3 CWE-79

TI-2025-16988 CVE-2025-23203

Icinga has rest API endpoints accessible to restricted users

LOW 25

Icinga Director is an Icinga config deployment tool.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00404 Published 2025-03-26 Fixed in 1.10.4, 1.11.4 CWE-200

TI-2024-32957 CVE-2024-49369

Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

MEDIUM 54

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02939 Published 2024-11-12 Fixed in 2.11.12, 2.12.11 +2 CWE-295

TI-2024-27855 CVE-2024-41811 · GHSA-w9pg-7c3h-fc8j

ipl/web susceptible to Cross-Site Request Forgery (CSRF)

LOW 18

ipl/web is a set of common web components for php projects.

CVSS 3.1LOW 3.9 Network High privileges User interaction EPSS 0.00184 Published 2024-08-05 Fixed in 0.10.1 CWE-352

TI-2024-16336 CVE-2024-24819

icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF

LOW 38

icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0026 Published 2024-02-09 Fixed in 0.22.0 CWE-352

TI-2024-16337 CVE-2024-24820

Icinga Director configuration is susceptible to Cross-Site Request Forgery

HIGH 69

Icinga Director is a tool designed to make Icinga 2 configuration handling easy.

CVSS 3.1HIGH 8.3 Network High privileges User interaction EPSS 0.00401 Published 2024-02-09 Fixed in 1.8.2, 1.9.2 +2 CWE-352

TI-2023-14423 CVE-2023-30607

icingaweb2-module-jira template and field configuration are susceptible to CSRF

LOW 38

icingaweb2-module-jira provides integration with Atlassian Jira.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00263 Published 2023-07-05 Fixed in 1.3.2 CWE-352

TI-2022-08529 CVE-2022-24714

Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2

LOW 33

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01221 Published 2022-03-08 Fixed in 2.8.6, 2.9.6 CWE-863

TI-2022-08531 CVE-2022-24716

Path traversal in Icinga Web 2

HIGH 81

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.89378 Published 2022-03-08 Fixed in 2.9.6 CWE-22

Vulnerabilities

Filters