Nagios vulnerabilities
119 CVEs and advisories name Nagios as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-34298Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation
- CVE-2025-34277Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID
- CVE-2025-34272Nagios Log Server < 2024R2.0.3 Non-Empty Default Dashboard Fallback
- CVE-2025-34273Nagios Log Server < 2024R2.0.3 Non-Admin Dashboard Deletion
- CVE-2024-58273Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to Root
- CVE-2025-34274Nagios Log Server < 2024R2.0.3 Logstash Process Root Privileges
- CVE-2023-7322Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API Access
- CVE-2016-15049Nagios Log Server < 1.4.2 Dashboards Logs Table XSS
- CVE-2025-34271Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext
- CVE-2025-34270Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated
- CVE-2017-20209Nagios Fusion < 4.0.1 XSS via Users/Servers Page
- CVE-2018-25119Nagios Fusion < 4.1.5 XSS via fusionwindow Parameter
- CVE-2023-53689Nagios Fusion < 4.2.0 License Information Reflected XSS
- CVE-2023-53690Nagios Fusion < 4.2.0 LDAP/AD Integration Stored XSS
- CVE-2023-7312Nagios Fusion < 4.2.0 Email Settings Stored XSS via SMTP/sendmail
- CVE-2025-44824Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslo
- CVE-2025-44823Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.ph
- CVE-2025-34227Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection
- CVE-2024-13986Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE
- CVE-2021-4285Nagios NCPA tail.html cross site scripting
- CVE-2021-33179The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting.
- CVE-2021-33177The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection.
- CVE-2018-15714Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters.
- CVE-2018-15713Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.
- CVE-2018-15712Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php.
- CVE-2018-15711Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users.
- CVE-2018-15710Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.
- CVE-2018-15709Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request.
- CVE-2018-15708Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.