Nagios vulnerabilities
119 CVEs and advisories name Nagios as an affected vendor, newest first. Follow it as a feed.
- CVE-2021-47696Nagios XI < 5.8.0 XSS via BPI Config ID Handling
- CVE-2023-7314Nagios XI < 5.11.3 XSS via Bandwidth Report
- CVE-2011-10036Nagios XI < 2011R1.9 XSS via backend_url JavaScript Link Handler
- CVE-2011-10039Nagios XI < 2011R1.9 XSS via Alert Heatmap Report & “My Reports” Listing
- CVE-2021-47699Nagios XI < 5.8.7 XSS in Audit Log via Send to NLS Form
- CVE-2023-53688Nagios XI < 5.11.3 XSS & CSRF via Hypermap Replay
- CVE-2023-7317Nagios XI < 2024R1 Web SSH Terminal Missing Access Control
- CVE-2020-36863Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import Directory
- CVE-2020-36862Nagios XI < 5.6.11 Unauthenticated XSS and SSRF via Highcharts
- CVE-2022-50587Nagios XI < 5.8.9 Stored XSS via Command Names in Apply Config Error Text
- CVE-2022-50586Nagios XI < 5.8.9 Stored XSS via BPI Info URL
- CVE-2022-50588Nagios XI < 5.8.9 Stored XSS in Update Checking
- CVE-2020-36869Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page
- CVE-2016-15050Nagios XI < 5.2.4 SQL Injection in Notification Search
- CVE-2024-13996Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change
- CVE-2024-13993Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers
- CVE-2013-10071Nagios XI < 2012R1.6 Reflected XSS via Dashlet AJAX Load Functionality
- CVE-2024-14008Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard
- CVE-2025-34286Nagios XI < 2026R1 RCE via Run Check Command in CCM
- CVE-2024-14003Nagios XI < 2024R1.2 RCE via NRDP Server Plugins
- CVE-2025-34134Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)
- CVE-2011-10035Nagios XI < 2011R1.9 Race Conditions in Crontab Install Scripts LPE
- CVE-2024-14009Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile
- CVE-2024-14004Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)
- CVE-2018-25123Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component
- CVE-2020-36868Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script
- CVE-2025-34287Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl
- CVE-2025-34135Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files
- CVE-2021-47700Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary Directory
- CVE-2024-14006Nagios XI < 2024R1.2.2 Host Header Injection