Icinga
45 CVEs across 14 Icinga products. Browse Icinga vulnerabilities, severities, and proof-of-concept exploits.
Icinga products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42224 | High | 7.6 | 2026-05-08 | ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javas… |
CVE-2026-24414 | Medium | 5.5 | 2026-01-29 | The Icinga PowerShell Framework provides configuration and check possibilities to ensure integration and monitoring of Windows environments. In versions prior… |
CVE-2026-24413 | Medium | 5.5 | 2026-01-29 | Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropr… |
CVE-2025-61909 | Medium | 4.4 | 2025-10-16 | Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icin… |
CVE-2025-61908 | Medium | 6.5 | 2025-10-16 | Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to nul… |
CVE-2025-61907 | Medium | 6.5 | 2025-10-16 | Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could a… |
CVE-2025-61789 | Medium | 5.3 | 2025-10-16 | Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom v… |
CVE-2025-53840 | Low | 2.4 | 2025-07-16 | Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependenc… |
CVE-2025-48057 | Critical | 9.8 | 2025-05-27 | Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Pr… |
CVE-2025-30164 | Medium | 4.1 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerab… |
CVE-2025-27609 | Medium | 5.4 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows a… |
CVE-2025-27406 | High | 7.6 | 2025-03-26 | Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability presen… |
CVE-2025-27405 | High | 7.6 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows a… |
CVE-2025-27404 | High | 7.6 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows a… |
CVE-2025-23203 | Medium | 5.5 | 2025-03-26 | Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on severa… |
CVE-2024-49369 | Critical | 9.8 | 2024-11-12 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The… |
CVE-2024-41811 | Low | 3.9 | 2024-08-05 | ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site… |
CVE-2024-24819 | Medium | 5.3 | 2024-02-09 | icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` is the base for vario… |
CVE-2024-24820 | High | 8.3 | 2024-02-09 | Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monito… |
CVE-2023-30607 | Medium | 5.0 | 2023-07-05 | icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field configuration forms p… |
CVE-2022-24716 | High | 7.5 | 2022-03-08 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the loca… |
CVE-2022-24715 | High | 8.5 | 2022-03-08 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can creat… |
CVE-2022-24714 | Medium | 5.3 | 2022-03-08 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affect… |
CVE-2021-37698 | High | 7.5 | 2021-08-19 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In v… |
CVE-2021-32743 | High | 8.8 | 2021-07-15 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In v… |
CVE-2021-32739 | High | 8.8 | 2021-07-15 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From… |
CVE-2021-32747 | Medium | 5.3 | 2021-07-12 | Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables are exposed to unauth… |
CVE-2021-32746 | Medium | 5.3 | 2021-07-12 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` module of Icinga Web… |
CVE-2020-29663 | Critical | 9.1 | 2020-12-15 | Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue… |
CVE-2020-24368 | High | 7.5 | 2020-08-19 | Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are rea… |
CVE-2020-14004 | High | 7.8 | 2020-06-12 | An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cm… |
CVE-2018-18250 | High | 7.5 | 2018-12-17 | Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item. |
CVE-2018-18249 | Critical | 9.8 | 2018-12-17 | Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the att… |
CVE-2018-18248 | Medium | 6.1 | 2018-12-17 | Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline qu… |
CVE-2018-18247 | Medium | 5.4 | 2018-12-17 | Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter. |
CVE-2018-18246 | Medium | 6.5 | 2018-12-17 | Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenabl… |
CVE-2018-6535 | High | 8.1 | 2018-02-27 | An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker. |
CVE-2018-6534 | Medium | 6.5 | 2018-02-27 | An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted messages, an attacker can cause a NULL pointer dereference, which can cause t… |
CVE-2018-6533 | High | 7.8 | 2018-02-27 | An issue was discovered in Icinga 2.x through 2.8.1. By editing the init.conf file, Icinga 2 can be run as root. Following this the program can be used to run… |
CVE-2018-6532 | High | 7.5 | 2018-02-27 | An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted (authenticated and unauthenticated) requests, an attacker can exhaust a lot o… |
CVE-2018-6536 | Medium | 5.5 | 2018-02-02 | An issue was discovered in Icinga 2.x through 2.8.1. The daemon creates an icinga2.pid file after dropping privileges to a non-root account, which might allow… |
CVE-2017-16933 | High | 7.0 | 2017-11-24 | etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user-writable directory, which allows local users to gain privileg… |
CVE-2017-16882 | High | 7.8 | 2017-11-18 | Icinga Core through 1.14.0 initially executes bin/icinga as root but supports configuration options in which this file is owned by a non-root account (and simi… |
CVE-2015-8010 | Medium | 6.1 | 2017-03-27 | Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inj… |
CVE-2014-2386 | | 2014-03-25 | Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (… | |
CVE-2014-1878 | | 2014-02-28 | Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5… | |
CVE-2013-7108 | | 2014-01-15 | Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticat… | |
CVE-2013-7107 | | 2014-01-15 | Cross-site request forgery (CSRF) vulnerability in cmd.cgi in Icinga 1.8.5, 1.9.4, 1.10.2, and earlier allows remote attackers to hijack the authentication of… | |
CVE-2013-7106 | | 2014-01-15 | Multiple stack-based buffer overflows in Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to cause a denial of se… | |
CVE-2012-6096 | | 2013-01-22 | Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4… | |
CVE-2012-3441 | | 2012-08-25 | The database creation script (module/idoutils/db/scripts/create_mysqldb.sh) in Icinga 1.7.1 grants access to all databases to the icinga user, which allows ici… | |
CVE-2011-2477 | | 2011-06-14 | Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escape_html_tags is disabled, allow remote attackers… | |
CVE-2011-2179 | | 2011-06-14 | Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject… |