# cve.now: Icinga

The newest entries naming Icinga as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-61552](https://cve.now/CVE-2026-61552.md): Icinga 2 DSL Injection via Unescaped Import Template Name (CVSS 7.2)
- [CVE-2026-61551](https://cve.now/CVE-2026-61551.md): Icinga 2: Stack overflow via deeply nested JSON objects (CVSS 8.6)
- [CVE-2026-61550](https://cve.now/CVE-2026-61550.md): Icinga 2: Improper access control for JSON-RPC update certificate messages (CVSS 9.8)
- [CVE-2026-42224](https://cve.now/CVE-2026-42224.md): ipl/web is vulnerable to reflected XSS by malformed search requests (CVSS 7.6)
- [CVE-2026-24414](https://cve.now/CVE-2026-24414.md): Icinga for Windows certificate can have too-open permissions (CVSS 6.8)
- [CVE-2026-24413](https://cve.now/CVE-2026-24413.md): Icinga has insecure permission of %ProgramData%\\icinga2\\var on Windows (CVSS 6.8)
- [CVE-2025-61909](https://cve.now/CVE-2025-61909.md): Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user (CVSS 4.0)
- [CVE-2025-61908](https://cve.now/CVE-2025-61908.md): Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference (CVSS 7.1)
- [CVE-2025-61907](https://cve.now/CVE-2025-61907.md): Icinga 2 API users could access restricted values in filter expressions (CVSS 7.1)
- [CVE-2025-61789](https://cve.now/CVE-2025-61789.md): Icinga DB Web hidden/protected custom variables are prone to filter enumeration (CVSS 5.3)
- [CVE-2025-53840](https://cve.now/CVE-2025-53840.md): Icinga DB Web Exposure of Sensitive Information to an Unauthorized Actor vulnerability (CVSS 2.4)
- [CVE-2025-48057](https://cve.now/CVE-2025-48057.md): Icinga 2 certificate renewal might incorrectly renew an invalid certificate (CVSS 9.3)
- [CVE-2025-30164](https://cve.now/CVE-2025-30164.md): Icinga Web 2 has open redirect on login page (CVSS 4.1)
- [CVE-2025-27609](https://cve.now/CVE-2025-27609.md): Icinga Web 2 Vulnerable to Reflected XSS (CVSS 1.1)
- [CVE-2025-27406](https://cve.now/CVE-2025-27406.md): Icinga Reporting Stored XSS leads to SSRF (CVSS 7.7)
- [CVE-2025-27405](https://cve.now/CVE-2025-27405.md): Icinga Web 2 has XSS in embedded content (CVSS 7.7)
- [CVE-2025-27404](https://cve.now/CVE-2025-27404.md): Icinga Web 2 DOM-based XSS vulnerability (CVSS 7.7)
- [CVE-2025-23203](https://cve.now/CVE-2025-23203.md): Icinga has rest API endpoints accessible to restricted users (CVSS 5.5)
- [CVE-2024-49369](https://cve.now/CVE-2024-49369.md): Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections (CVSS 9.8)
- [CVE-2024-41811](https://cve.now/CVE-2024-41811.md): ipl/web susceptible to Cross-Site Request Forgery (CSRF) (CVSS 3.9)
- [CVE-2024-24819](https://cve.now/CVE-2024-24819.md): icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF (CVSS 5.3)
- [CVE-2024-24820](https://cve.now/CVE-2024-24820.md): Icinga Director configuration is susceptible to Cross-Site Request Forgery (CVSS 8.3)
- [CVE-2023-30607](https://cve.now/CVE-2023-30607.md): icingaweb2-module-jira template and field configuration are susceptible to CSRF (CVSS 5.0)
- [CVE-2022-24714](https://cve.now/CVE-2022-24714.md): Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2 (CVSS 5.3)
- [CVE-2022-24716](https://cve.now/CVE-2022-24716.md): Path traversal in Icinga Web 2 (CVSS 7.5)
- [CVE-2022-24715](https://cve.now/CVE-2022-24715.md): Arbitrary code execution for authenticated users in Icinga Web 2 (CVSS 8.5)
- [CVE-2021-37698](https://cve.now/CVE-2021-37698.md): Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer (CVSS 7.5)
- [CVE-2021-32743](https://cve.now/CVE-2021-32743.md): Passwords used to access external services inadvertently exposed through API (CVSS 8.8)
- [CVE-2021-32739](https://cve.now/CVE-2021-32739.md): Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities (CVSS 8.8)
- [CVE-2021-32747](https://cve.now/CVE-2021-32747.md): Custom variable protection and blacklists can be circumvented (CVSS 5.3)
- [CVE-2021-32746](https://cve.now/CVE-2021-32746.md): Possible path traversal by use of the \`doc\` module (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/icinga
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.