Icinga vulnerabilities

Products

• Icinga 31
• Web 2 14
• Icinga2 12
• Icingaweb2 9
• Db Web 2
• Icingadb-web 2
• Icingaweb2-module-director 2
• Ipl-web 2

Newest

• icinga icinga2 Icinga 2 DSL Injection via Unescaped Import Template Name CVE-2026-61552 Fix available 7.2 HighSeptember 18, 2026
• icinga icinga2 Icinga 2: Stack overflow via deeply nested JSON objects CVE-2026-61551 Fix available 8.6 HighSeptember 18, 2026
• icinga icinga2 Icinga 2: Improper access control for JSON-RPC update certificate messages CVE-2026-61550 Fix available 9.8 CriticalSeptember 18, 2026
• icinga ipl-web ipl/web is vulnerable to reflected XSS by malformed search requests CVE-2026-42224 Fix available 7.6 HighApril 29, 2026
• icinga icinga-powershell-framework, powershell framework +1 more Icinga for Windows certificate can have too-open permissions CVE-2026-24414 6.8 MediumJanuary 29, 2026
• icinga, icinga icinga2 +1 more Icinga has insecure permission of %ProgramData%\icinga2\var on Windows CVE-2026-24413 Fix available 6.8 MediumJanuary 29, 2026
• icinga, icinga icinga2 +1 more Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user CVE-2025-61909 Fix available 4.0 MediumOctober 16, 2025
• icinga, icinga icinga2 +1 more Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference CVE-2025-61908 Fix available 7.1 HighOctober 16, 2025
• icinga, icinga icinga2 +1 more Icinga 2 API users could access restricted values in filter expressions CVE-2025-61907 Fix available 7.1 HighOctober 16, 2025
• icinga db web, icingadb-web +1 more Icinga DB Web hidden/protected custom variables are prone to filter enumeration CVE-2025-61789 Fix available 5.3 MediumOctober 16, 2025
• icinga db web, icingadb-web +1 more Icinga DB Web Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2025-53840 2.4 LowJuly 16, 2025
• icinga, icinga icinga2 +1 more Icinga 2 certificate renewal might incorrectly renew an invalid certificate CVE-2025-48057 Fix available 9.3 CriticalMay 27, 2025
• icinga icingaweb2-module-reporting Icinga Reporting Stored XSS leads to SSRF CVE-2025-27406 Fix available 7.7 HighMarch 26, 2025
• icinga icingaweb2-module-director Icinga has rest API endpoints accessible to restricted users CVE-2025-23203 Fix available 5.5 MediumMarch 26, 2025
• icinga web 2, icingaweb2 +1 more Icinga Web 2 has open redirect on login page CVE-2025-30164 Fix available 4.1 MediumMarch 26, 2025
• icinga web 2, icingaweb2 +1 more Icinga Web 2 Vulnerable to Reflected XSS CVE-2025-27609 Fix available 1.1 LowMarch 26, 2025
• icinga web 2, icingaweb2 +1 more Icinga Web 2 has XSS in embedded content CVE-2025-27405 Fix available 7.7 HighMarch 26, 2025
• icinga web 2, icingaweb2 +1 more Icinga Web 2 DOM-based XSS vulnerability CVE-2025-27404 Fix available 7.7 HighMarch 26, 2025
• icinga, debian linux, icinga icinga2 +1 more +3 more Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections CVE-2024-49369 Public exploitFix available 9.8 CriticalNovember 12, 2024
• icinga ipl-web ipl/web susceptible to Cross-Site Request Forgery (CSRF) CVE-2024-41811 Fix available 3.9 LowAugust 5, 2024
• icinga icingaweb2-module-incubator icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF CVE-2024-24819 5.3 MediumFebruary 9, 2024
• icinga, icinga icingaweb2-module-director +1 more Icinga Director configuration is susceptible to Cross-Site Request Forgery CVE-2024-24820 Fix available 8.3 HighFebruary 9, 2024
• icinga icingaweb2-module-jira, web jira integration +1 more icingaweb2-module-jira template and field configuration are susceptible to CSRF CVE-2023-30607 5.0 MediumJuly 5, 2023
• icinga web 2, icingaweb2 +1 more Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2 CVE-2022-24714 Fix available 5.3 MediumMarch 8, 2022
• icinga web 2, icingaweb2 +1 more Path traversal in Icinga Web 2 CVE-2022-24716 Public exploitFix available EPSS 89.4% 7.5 HighMarch 8, 2022
• icinga web 2, icingaweb2 +1 more Arbitrary code execution for authenticated users in Icinga Web 2 CVE-2022-24715 Public exploitFix available EPSS 14.9% 8.5 HighMarch 8, 2022
• icinga, debian linux, icinga icinga2 +2 more Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer CVE-2021-37698 Fix available 7.5 HighAugust 19, 2021
• icinga, debian linux, icinga icinga2 +2 more Passwords used to access external services inadvertently exposed through API CVE-2021-32743 Fix available 8.8 HighJuly 15, 2021
• icinga, debian linux, icinga icinga2 +2 more Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities CVE-2021-32739 Fix available 8.8 HighJuly 15, 2021
• icinga, icinga icingaweb2 +1 more Custom variable protection and blacklists can be circumvented CVE-2021-32747 Fix available 5.3 MediumJuly 12, 2021
• icinga, icinga icingaweb2 +1 more Possible path traversal by use of the `doc` module CVE-2021-32746 Fix available 5.3 MediumJuly 12, 2021
• icinga Security update for icinga2 CVE-2020-29663 Fix available 9.1 CriticalDecember 15, 2020
• icinga web 2, debian linux, suse package hub +2 more Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability... CVE-2020-24368 Fix available 7.5 HighAugust 19, 2020
• icinga, opensuse backports sle, leap +2 more An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of... CVE-2020-14004 Fix available 7.8 HighJune 12, 2020
• icinga web 2 Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a... CVE-2018-18250 Fix available 7.5 HighDecember 17, 2018
• icinga web 2 Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving... CVE-2018-18249 Fix available 9.8 CriticalDecember 17, 2018
• icinga web 2 Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2... CVE-2018-18248 Fix available 6.1 MediumDecember 17, 2018
• icinga web 2 Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter. CVE-2018-18247 Fix available 5.4 MediumDecember 17, 2018
• icinga web 2 Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to... CVE-2018-18246 Fix available 6.5 MediumDecember 17, 2018
• icinga An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password... CVE-2018-6535 Fix available 8.1 HighFebruary 27, 2018
• icinga An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an... CVE-2018-6534 Fix available 6.5 MediumFebruary 27, 2018
• icinga An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can... CVE-2018-6533 Fix available 7.8 HighFebruary 27, 2018
• icinga An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted (authenticated... CVE-2018-6532 Fix available 7.5 HighFebruary 27, 2018
• icinga An issue was discovered in Icinga 2.x through 2.8.1. The daemon creates an icinga2.pid file after... CVE-2018-6536 Fix available 5.5 MediumFebruary 2, 2018
• icinga etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user... CVE-2017-16933 Fix available 7.0 HighNovember 24, 2017
• icinga Icinga Core through 1.14.0 initially executes bin/icinga as root but supports configuration... CVE-2017-16882 7.8 HighNovember 18, 2017
• icinga, opensuse leap +1 more Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and... CVE-2015-8010 Fix available 6.1 MediumMarch 27, 2017
• icinga, opensuse +1 more Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to... CVE-2014-2386 Fix available 5.0 MediumMarch 25, 2014
• icinga, nagios +1 more Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0... CVE-2014-1878 Fix available 5.0 MediumFebruary 28, 2014
• icinga, nagios +1 more Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9... CVE-2013-7108 Public exploitFix available EPSS 61.6% 5.5 MediumJanuary 14, 2014
• Show olderLoading…