Cacti vulnerabilities

Products

• Cacti 158

Newest

• cacti Cacti: User Enumeration via Error Messages CVE-2026-49442 Fix available 5.3 MediumOctober 23, 2026
• cacti Cacti: Authenticated RCE on Data Input CVE-2026-39902 Public exploitFix available 7.2 HighOctober 23, 2026
• cacti Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368) CVE-2026-46531 Fix available 5.5 MediumOctober 23, 2026
• cacti Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection CVE-2026-71287 8.8 HighAugust 5, 2026
• cacti Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages CVE-2026-40941 Fix available 7.1 HighJune 25, 2026
• cacti Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter CVE-2026-40084 Fix available 6.5 MediumJune 25, 2026
• cacti Cacti: SQL Injection in managers.php CVE-2026-40083 Public exploitFix available 7.2 HighJune 25, 2026
• cacti Cacti: Session Fixation via missing session_regenerate_id() after login CVE-2026-40082 Fix available 5.4 MediumJune 25, 2026
• cacti Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect CVE-2026-40080 Fix available 6.1 MediumJune 25, 2026
• cacti Cacti: Command Injection via escape_command() no-op in RRDtool execution CVE-2026-40079 Fix available 8.6 HighJune 24, 2026
• cacti Cacti: Stored SQL Injection via graph_name_regexp in Reports feature CVE-2026-39951 Fix available 7.6 HighJune 24, 2026
• cacti Cacti has SQL Injection via rfilter parameter in RLIKE clauses CVE-2026-39948 Fix available 9.3 CriticalJune 24, 2026
• cacti Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php CVE-2026-39955 Fix available 9.8 CriticalJune 24, 2026
• cacti Cacti: Unauthenticated RCE on Graph Image CVE-2026-39938 Public exploitFix available 9.8 CriticalJune 24, 2026
• cacti Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript context CVE-2026-39900 Fix available 5.3 MediumJune 24, 2026
• cacti Cacti: Path Traversal via filename parameter in package_import.php CVE-2026-39899 Fix available 6.9 MediumJune 24, 2026
• cacti Cacti has a Reflected XSS Vulnerability via html_auth_footer CVE-2026-39897 Fix available 5.3 MediumJune 24, 2026
• cacti Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting CVE-2026-39894 Fix available 2.9 LowJune 24, 2026
• cacti Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php CVE-2026-39893 Fix available 9.8 CriticalJune 24, 2026
• cacti SNMP Command Injection leads to RCE in Cacti CVE-2025-66399 Fix available EPSS 10.8% 7.4 HighDecember 2, 2025
• cacti Cacti graph_view.php RCE via graph_start Parameter Injection CVE-2005-10004 Public exploitFix available 8.7 HighAugust 30, 2025
• cacti Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the... CVE-2025-26520 Fix available 7.6 HighFebruary 12, 2025
• cacti Cacti has a SQL Injection vulnerability when using tree rules through Automation API CVE-2025-24368 Fix available 6.9 MediumJanuary 27, 2025
• cacti Cacti allows Arbitrary File Creation leading to RCE CVE-2025-24367 Public exploitFix available EPSS 58.8% 8.7 HighJanuary 27, 2025
• cacti Cacti has Authenticated RCE via multi-line SNMP responses CVE-2025-22604 Public exploitFix available 9.1 CriticalJanuary 27, 2025
• cacti Cacti has a SQL Injection vulnerability when request automation devices CVE-2024-54145 Fix available 6.3 MediumJanuary 27, 2025
• cacti Cacti has a SQL Injection vulnerability when view host template CVE-2024-54146 Fix available EPSS 45.9% 7.6 HighJanuary 27, 2025
• cacti Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path CVE-2024-45598 Fix available 6.0 MediumJanuary 27, 2025
• cacti Remote code execution via Log Poisoning in Cacti CVE-2024-43363 Public exploitFix available EPSS 35.6% 7.2 HighOctober 7, 2024
• cacti Stored Cross-site Scripting (XSS) when creating external links in Cacti CVE-2024-43365 Fix available EPSS 25.1% 5.7 MediumOctober 7, 2024
• cacti Stored Cross-site Scripting (XSS) when creating external links in Cacti CVE-2024-43364 Fix available EPSS 37.9% 5.7 MediumOctober 7, 2024
• cacti Stored Cross-site Scripting (XSS) when creating external links in Cacti CVE-2024-43362 Fix available EPSS 38.6% 7.3 HighOctober 7, 2024
• cacti, fedoraproject fedora +1 more Authentication Bypass when using using older password hashes CVE-2024-34340 Fix available 9.1 CriticalMay 13, 2024
• cacti, fedoraproject fedora +1 more Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database CVE-2024-31460 Fix available 6.5 MediumMay 13, 2024
• cacti, fedoraproject fedora +1 more Cacti RCE vulnerability by file include in lib/plugin.php CVE-2024-31459 Fix available 8.1 HighMay 13, 2024
• cacti, fedoraproject fedora +1 more Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database CVE-2024-31458 Fix available EPSS 12.6% 4.6 MediumMay 13, 2024
• cacti, fedoraproject fedora +1 more SQL Injection vulnerability in automation_get_new_graphs_sql CVE-2024-31445 Fix available EPSS 26.2% 8.8 HighMay 13, 2024
• cacti, fedoraproject fedora +1 more Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database CVE-2024-31444 Fix available EPSS 14.7% 4.6 MediumMay 13, 2024
• cacti, fedoraproject fedora +1 more Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database CVE-2024-31443 Fix available 5.7 MediumMay 13, 2024
• cacti Cacti XSS vulnerability in display_settings CVE-2024-30268 6.1 MediumMay 13, 2024
• cacti Cacti command injection in cmd_realtime.php CVE-2024-29895 Public exploit EPSS 98.8% 10.0 CriticalMay 13, 2024
• cacti, fedoraproject fedora +1 more Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API CVE-2024-29894 Fix available 5.4 MediumMay 13, 2024
• cacti Cacti Cross-site Scripting vulnerability when managing trees CVE-2024-27082 Fix available 7.6 HighMay 13, 2024
• cacti, fedoraproject fedora +1 more Cacti RCE vulnerability when importing packages CVE-2024-25641 Public exploitFix available EPSS 86.3% 9.1 CriticalMay 13, 2024
• cacti SQL Injection vulnerability when managing SNMP Notification Receivers CVE-2023-51448 Fix available EPSS 67.3% 8.8 HighDecember 22, 2023
• cacti Cross-Site Scripting vulnerability when Import xml template file CVE-2023-50250 Fix available 5.4 MediumDecember 22, 2023
• cacti Cacti has incomplete fix for CVE-2023-39515 CVE-2023-49088 Fix available 6.1 MediumDecember 22, 2023
• cacti Cacti SQL Injection vulnerability CVE-2023-49085 Public exploitFix available EPSS 74.5% 8.8 HighDecember 22, 2023
• cacti Cacti is vulnerable to cross-Site scripting (XSS) DOM CVE-2023-49086 Fix available 5.4 MediumDecember 21, 2023
• cacti Local File Inclusion (RCE) in Cacti CVE-2023-49084 Public exploitFix available EPSS 64.4% 8.1 HighDecember 21, 2023
• Show olderLoading…