# cve.now: Nezhahq

The newest entries naming Nezhahq as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120046](https://cve.now/CVE-2026-120046.md): Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History (CVSS 6.0)
- [CVE-2026-111387](https://cve.now/CVE-2026-111387.md): Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint (CVSS 7.1)
- [CVE-2026-111386](https://cve.now/CVE-2026-111386.md): Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig (CVSS 5.3)
- [CVE-2026-111385](https://cve.now/CVE-2026-111385.md): Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools (CVSS 6.3)
- [CVE-2026-111384](https://cve.now/CVE-2026-111384.md): Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket (CVSS 7.1)
- [CVE-2026-111383](https://cve.now/CVE-2026-111383.md): Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket (CVSS 7.1)
- [CVE-2026-100394](https://cve.now/CVE-2026-100394.md): Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant (CVSS 6.5)
- [CVE-2026-105113](https://cve.now/CVE-2026-105113.md): Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock (CVSS 7.1)
- [CVE-2026-105112](https://cve.now/CVE-2026-105112.md): Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints (CVSS 6.0)
- [CVE-2026-101090](https://cve.now/CVE-2026-101090.md): Nezha through 2.2.3 Host Header Injection via OAuth2 redirect\_uri (CVSS 9.3)
- [CVE-2026-101089](https://cve.now/CVE-2026-101089.md): Nezha before 2.2.7 Information Disclosure via /api/v1/profile (CVSS 2.3)
- [CVE-2026-101088](https://cve.now/CVE-2026-101088.md): Nezha before 2.3.1 Denial of Service via Concurrent Server Delete (CVSS 6.0)
- [CVE-2026-101087](https://cve.now/CVE-2026-101087.md): Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 (CVSS 5.3)
- [CVE-2026-101086](https://cve.now/CVE-2026-101086.md): Nezha Dashboard before 2.3.5 Task Type Validation Bypass (CVSS 7.1)
- [CVE-2026-101085](https://cve.now/CVE-2026-101085.md): Nezha before 2.3.8 Denial of Service via Alert Rule (CVSS 7.1)
- [CVE-2026-62283](https://cve.now/CVE-2026-62283.md): Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check (CVSS 9.9)
- [CVE-2026-59155](https://cve.now/CVE-2026-59155.md): Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API (CVSS 6.9)
- [CVE-2026-53523](https://cve.now/CVE-2026-53523.md): Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection (CVSS 6.8)
- [CVE-2026-53522](https://cve.now/CVE-2026-53522.md): Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS (CVSS 6.5)
- [CVE-2026-53521](https://cve.now/CVE-2026-53521.md): Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context (CVSS 6.4)
- [CVE-2026-53520](https://cve.now/CVE-2026-53520.md): Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing (CVSS 6.5)
- [CVE-2026-53519](https://cve.now/CVE-2026-53519.md): Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt\_secret\_key (CVSS 9.1)
- [CVE-2026-49397](https://cve.now/CVE-2026-49397.md): Nezha Monitoring: Private services (\`EnableShowInService: false\`) are enumerable via per-server endpoints, leaking name and timing data (CVSS 5.3)
- [CVE-2026-49396](https://cve.now/CVE-2026-49396.md): Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents (CVSS 7.1)
- [CVE-2026-48119](https://cve.now/CVE-2026-48119.md): Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services (CVSS 7.1)
- [CVE-2026-47124](https://cve.now/CVE-2026-47124.md): Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members (CVSS 6.5)
- [CVE-2026-47120](https://cve.now/CVE-2026-47120.md): Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) (CVSS 7.1)
- [CVE-2026-46717](https://cve.now/CVE-2026-46717.md): Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification (CVSS 7.7)
- [CVE-2026-46716](https://cve.now/CVE-2026-46716.md): Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron (CVSS 9.9)
- [CVE-2026-47268](https://cve.now/CVE-2026-47268.md): Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host (CVSS 6.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nezhahq
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.