Skip to content
OpenAdvisories

Vendor

Nagios Enterprises, LLC.

11 known vulnerabilities.

Nagios Enterprises, LLC. at a glance

Last 12 months
9
Critical · all time
0
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 7 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 1 vulnerability
Show as table
MonthVulnerabilitiesCritical
Nov 202610
Oct 202600
Sep 202600
Aug 202670
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202510
Nov 202500
Oct 202500
Sep 202500
Aug 202510
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Nagios XI 8 Nagios Core 7 nagios 1 Nagios XI Graph Explorer 1 Nagios XI < 5.11.3 0 Nagios XI < 5.11.2 0 Nagios XI < 2024R1.0.1 0 Nagios XI <= 5.7.1 0

Latest advisories

  • Medium max 7.2
    WID-SEC-2026-4323 1 CVE

    Nagios Enterprises Nagios XI: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Benutzerrechten

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Nagios Enterprises Nagios XI ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen.

    Nagios Enterprises, LLC. Linux Windows
  • High max 7.5
    WID-SEC-2026-2819 5 CVEs rev. 2

    Nagios Core und Nagios XI: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Nagios Core und Nagios Enterprises Nagios XI ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.

    Debian Nagios Enterprises, LLC. Windows
    first Aug 12, 2026
  • Medium max 3.5
    WID-SEC-2023-0316 2 CVEs rev. 3

    Nagios Enterprises Nagios XI: Mehrere Schwachstellen

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Nagios Enterprises Nagios XI ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um den Benutzer zu täuschen.

    Nagios Enterprises, LLC. Linux Windows
    first Feb 8, 2023
  • Medium max 7.2
    WID-SEC-2026-0406 3 CVEs

    Nagios Enterprises Nagios XI: Mehrere Schwachstellen ermöglichen Codeausführung

    Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Nagios Enterprises Nagios XI ausnutzen, um beliebigen Programmcode auszuführen.

    Nagios Enterprises, LLC. Linux
  • Medium max 8.8
    WID-SEC-2025-2932 2 CVEs

    Nagios Enterprises Nagios XI: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Nagios Enterprises Nagios XI ausnutzen, um Informationen offenzulegen, und um einen SQL-Injection Angriff durchzuführen.

    Nagios Enterprises, LLC. Linux Windows
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • High 7.2
    CVE-2026-119742

    Nagios XI < 2026R2 OS Command Injection via mibs.php

    Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-s…

    Nagios Enterprises, LLC. Nagios XI nagios4 nagios3 Ubuntu
  • Medium 6.5
    CVE-2026-48549

    Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie

    Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allo…

    Nagios Enterprises, LLC. Nagios XI Nagios Core nagios4 Debian Ubuntu
  • Medium 6.5
    CVE-2026-48548

    Nagios Core CSRF via cmd.cgi

    Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Na…

    Nagios Enterprises, LLC. Nagios Core nagios4 nagios4 Debian Ubuntu
  • High 7.5
    CVE-2026-48554

    Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or…

    Nagios Enterprises, LLC. Nagios XI Nagios Core nagios4 Debian Ubuntu
  • High 7.5
    CVE-2026-48553

    Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection

    Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is…

    Nagios Enterprises, LLC. Nagios XI Nagios Core nagios4 Debian Ubuntu
  • Medium 5.4
    CVE-2026-48552

    Nagios Core / XI DOM-based XSS via jsonquery.js

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbit…

    Nagios Enterprises, LLC. Nagios XI Nagios Core nagios4 Debian Ubuntu
  • High 7.4
    CVE-2026-48551

    Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling un…

    Nagios Enterprises, LLC. Nagios XI Nagios Core nagios4 Debian Ubuntu
  • Medium 6.1
    CVE-2026-48550

    Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter

    Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, execut…

    Nagios Enterprises, LLC. Nagios XI Nagios Core nagios4 Debian Ubuntu
  • High 8.6
    CVE-2025-34288

    Nagios XI Privilege Escalation via Writable PHP Include Executed with Sudo

    Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and application file permissions. A user‑accessible maintenance script may be executed as root via sudo and includes an app…

    Nagios Enterprises, LLC. Nagios XI
  • High 8.6
    CVE-2012-10029 Public exploit

    Nagios XI Network Monitor Graph Explorer Component < 1.3 Authenticated Command Injection

    Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can inject system commands via unsanitized parameters such as `host`, resulting in remote code execution.

    Nagios Enterprises, LLC. Nagios XI Graph Explorer
  • Medium 6.7
    CVE-2016-8641 Public exploit

    A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary fi…

    Nagios Enterprises, LLC. nagios