Icinga web 2

This hub aggregates every CVE we track for Icinga web 2, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Icinga web 2.

• CVE-2025-30164Icinga Web 2 has open redirect on login page4.1Mar 26, 2025
• CVE-2025-27609Icinga Web 2 Vulnerable to Reflected XSS5.4Mar 26, 2025
• CVE-2025-27405Icinga Web 2 has XSS in embedded content7.6Mar 26, 2025
• CVE-2025-27404Icinga Web 2 DOM-based XSS vulnerability7.6Mar 26, 2025
• CVE-2024-24819icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF5.3Feb 9, 2024
• CVE-2022-24714Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 25.3Mar 8, 2022
• CVE-2022-24716Path traversal in Icinga Web 27.5Mar 8, 2022
• CVE-2022-24715Arbitrary code execution for authenticated users in Icinga Web 28.5Mar 8, 2022
• CVE-2021-32747Custom variable protection and blacklists can be circumvented5.3Jul 12, 2021
• CVE-2021-32746Possible path traversal by use of the `doc` module5.3Jul 12, 2021
• CVE-2020-24368Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga We...7.5Aug 19, 2020
• CVE-2018-18248Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup q...6.1Dec 17, 2018
• CVE-2018-18249Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=${PATH}_${APACHE...9.8Dec 17, 2018
• CVE-2018-18247Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.5.4Dec 17, 2018
• CVE-2018-18250Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item.7.5Dec 17, 2018