Skip to content
OpenAdvisories

Package · Debian

cacti

175 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-39938 Public exploit

    Cacti: Unauthenticated RCE on Graph Image

    Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

    Cacti cacti cacti cacti Debian Ubuntu
  • Critical 9.1
    CVE-2025-22604 Public exploit

    Cacti has Authenticated RCE via multi-line SNMP responses

    Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of e…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2024-48910 Public exploit

    DOMPurify vulnerable to tampering by prototype polution

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

    cure53 DOMPurify cacti dompurify Debian Ubuntu npm
  • Critical 10.0
    CVE-2024-47875 Public exploit

    DOMPurify nesting-based mXSS

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

    cure53 DOMPurify cacti dompurify Debian Ubuntu npm
  • Critical 9.1
    CVE-2024-25641 Public exploit EPSS 86%

    Cacti RCE vulnerability when importing packages

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to e…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2023-39361 Public exploit Scanner template EPSS 89%

    Unauthenticated SQL Injection in graph_view.php in Cacti

    Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are bei…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2022-46169 Exploited Public exploit Scanner template EPSS 100%

    Unauthenticated Command Injection

    Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a serve…

    Cacti cacti cacti cacti Debian Ubuntu
    KEV Feb 16, 2023