Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2026-48549

Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute Nagios commands as a currently authenticated user.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Core Nagios Xi Xi
CVE-2026-48548

Nagios Core CSRF via cmd.cgi

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently authenticated user without their knowledge or consent.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Core
CVE-2026-48554

Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requires a non-default configuration in which a notification command references these macros in a shell-executed command line.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Core Nagios Xi
CVE-2026-48553

Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is referenced in a shell-executed command line, an authenticated attacker with NRDP access can inject OS commands through the macro value. Exploitation requires a non-default configuration in which a custom variable is defined and referenced in a shell-executed command.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Core Nagios Xi
CVE-2026-48552

Nagios Core / XI DOM-based XSS via jsonquery.js

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Core Nagios Xi
CVE-2026-48551

Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Core Nagios Xi
CVE-2026-48550

Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Core Nagios Xi
CVE-2017-14312

nagios: Incorrect file permissions leading to possible privilege escalation

Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and similarly can have nagios.cfg owned by a non-root account), which allows local users to gain privileges by leveraging access to this non-root account.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Core
CVE-2020-35269

nagios: site-wide Cross Site Request Forgery

Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or servers.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Nagios
Products
Nagios Core
CVE-2018-18245

nagios: Stored XSS via Plugin Output

Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE.

CVSS 3.0 · 5.4 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Nagios
Products
Debian Linux Nagios Core
CVE-2018-13458

nagios: NULL pointer dereference in qh_core in base/query-handler.c

qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.

CVSS 3.0 · 5.5 Medium EPSS 4.5% KEV · Not listed
Vendors
Nagios
Products
Nagios Core
CVE-2018-13457

nagios: NULL pointer dereference in qh_echo in base/query-handler.c

qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.

CVSS 3.0 · 5.5 Medium EPSS 4.5% KEV · Not listed
Vendors
Nagios
Products
Nagios Core