CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,500 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,500
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product nagios:nagios_xi. Show all products

88 CVEs, showing 51 to 88PreviousPage 2 of 2
CVESeverityTitlePublished
CVE-2022-50588Medium 5.4Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the update checking feature.Oct 30, 2025
CVE-2023-53688Medium 5.4Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component.Oct 30, 2025
CVE-2023-7313Medium 5.4Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool.Oct 30, 2025
CVE-2023-7314Medium 5.4Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component.Oct 30, 2025
CVE-2023-7315Medium 5.4Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component.Oct 30, 2025
CVE-2023-7316Medium 5.4Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component.Oct 30, 2025
CVE-2023-7317High 8.8Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal.Oct 30, 2025
CVE-2023-7318Medium 5.4Nagios XI versions prior to < 2024R1.0.2 are vulnerable to cross-site scripting (XSS) via the Nagios Core Command Expansion page.Oct 30, 2025
CVE-2024-13993Medium 6.1Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers.Oct 30, 2025
CVE-2024-13994Critical 9.8Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled.Oct 30, 2025
CVE-2024-13995High 8.8Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who shou…Oct 30, 2025
CVE-2024-13996Critical 9.8Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed.Oct 30, 2025
CVE-2024-13999Critical 9.8Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticated user.Oct 30, 2025
CVE-2024-14000Medium 5.4Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Capacity Planning Report component.Oct 30, 2025
CVE-2024-14001Medium 5.4Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Executive Summary Report component.Oct 30, 2025
CVE-2024-14002Medium 5.5Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration.Oct 30, 2025
CVE-2024-14003Critical 9.8Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins.Oct 30, 2025
CVE-2024-14004High 8.8Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf).Oct 30, 2025
CVE-2024-14005High 8.8Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard.Oct 30, 2025
CVE-2024-14006Medium 6.1Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability.Oct 30, 2025
CVE-2024-14008High 7.2Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard.Oct 30, 2025
CVE-2024-14009High 7.2Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component.Oct 30, 2025
CVE-2025-34134High 7.2Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component.Oct 30, 2025
CVE-2025-34135Medium 4.4Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive.Oct 30, 2025
CVE-2025-34283Medium 6.5Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes.Oct 30, 2025
CVE-2025-34284High 8.8Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin.Oct 30, 2025
CVE-2025-34286High 7.2Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command.Oct 30, 2025
CVE-2025-34287High 7.8Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-data.Oct 30, 2025
CVE-2024-13992Medium 5.4Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website.Oct 31, 2025
CVE-2021-47698Medium 5.4Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string()).Nov 3, 2025
CVE-2024-13997High 7.2Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the…Nov 3, 2025
CVE-2024-13998Medium 6.5Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have a…Nov 3, 2025
CVE-2025-34288Medium 6.7Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and application file permissions.Dec 16, 2025
CVE-2025-67254High 7.5NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.Dec 29, 2025
CVE-2025-67255High 8.8In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.Dec 29, 2025
CVE-2026-2041High 8.8Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability.Feb 20, 2026
CVE-2026-2042High 8.8Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability.Feb 20, 2026
CVE-2026-2043High 8.8Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability.Feb 20, 2026
PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.