Nagios Enterprises, Llc. Nagios Core
7 CVEs affecting Nagios Enterprises, Llc. Nagios Core. Latest disclosed: 2026-08-26. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48554 | High | 7.5 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitu… |
CVE-2026-48553 | High | 7.5 | 2026-08-12 | Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the N… |
CVE-2026-48551 | High | 7.4 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An att… |
CVE-2026-48549 | Medium | 6.5 | 2026-08-26 | Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie pr… |
CVE-2026-48548 | Medium | 6.5 | 2026-08-26 | Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagForm… |
CVE-2026-48550 | Medium | 6.1 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthentic… |
CVE-2026-48552 | Medium | 5.4 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflecte… |