Nagios core

This hub aggregates every CVE we track for Nagios core, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 12 most recently published vulnerabilities affecting Nagios core.

• CVE-2026-48549Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie6.5Aug 26, 2026
• CVE-2026-48548Nagios Core CSRF via cmd.cgi6.5Aug 26, 2026
• CVE-2026-48554Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution7.5Aug 12, 2026
• CVE-2026-48553Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection7.5Aug 12, 2026
• CVE-2026-48552Nagios Core / XI DOM-based XSS via jsonquery.js5.4Aug 12, 2026
• CVE-2026-48551Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie7.4Aug 12, 2026
• CVE-2026-48550Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter6.1Aug 12, 2026
• CVE-2020-35269Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or servers.8.8Dec 23, 2020
• CVE-2018-18245Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE.5.4Dec 17, 2018
• CVE-2018-13458qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to th...5.5Jul 12, 2018
• CVE-2018-13457qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to th...5.5Jul 12, 2018
• CVE-2017-14312Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and similarly can have nagios.cfg owned b...7.8Sep 11, 2017