Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Vendor: Nagios Enterprises, LLC. Clear all filters
TI-2026-84257 CVE-2026-119742 · GHSA-xgjr-r6p2-hvm3

OS command injection in Nagios XI via MIB upload

Priority MEDIUM 46

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.04088 Published 2026-11-03 Fixed in 2026R2 CWE-78
TI-2026-35908 CVE-2026-48549 · GHSA-xm5q-p2r5-r5wj

Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie

Priority LOW 36

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi.

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00256 Published 2026-08-26 Fixed in 4.5.13, 2026R1.5 CWE-352
TI-2026-35907 CVE-2026-48548 · GHSA-5xj4-4632-2x3r

Nagios Core CSRF via cmd.cgi

Priority LOW 30

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent.

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00212 Published 2026-08-26 Fixed in 4.5.12 CWE-352
TI-2026-35912 CVE-2026-48553 · GHSA-r6wg-9vj9-rm67

Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection

Priority LOW 38

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP).

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00966 Published 2026-08-12 Fixed in 4.5.13, 2026R1.5 CWE-78
TI-2026-35911 CVE-2026-48552 · GHSA-m927-w885-wph8

Nagios Core / XI DOM-based XSS via jsonquery.js

Priority LOW 23

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00289 Published 2026-08-12 Fixed in 4.5.14, 2026R1.7 CWE-79
TI-2026-35910 CVE-2026-48551 · GHSA-4f3c-j3m4-8h7h

Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie

Priority LOW 27

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie.

CVSS 4.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00264 Published 2026-08-12 Fixed in 4.5.14, 2026R1.7 CWE-352
TI-2026-35909 CVE-2026-48550 · GHSA-hc96-98mh-7j3h

Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter

Priority LOW 24

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00438 Published 2026-08-12 Fixed in 4.5.14, 2026R1.7 CWE-79