Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Dec 3, 2025User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to enumerate Checkmk usernames.CVE-2025-39665 · Other software · Nagvis · reported by security@checkmk.comMedium 6.9
User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to enumerate Checkmk usernames.
- Product
- Nagvis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf).CVE-2024-14004 · Other software · Nagios · reported by VulnCheckHigh 8.7
Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf). An authenticated user could manipulate NagVis configuration data or leverage insufficiently validated configuration settings to obtain elevated privileges on the Nagios XI system.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration.CVE-2024-14002 · Other software · Nagios · reported by VulnCheckHigh 7.1
Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025Improper neutralization of input in Nagvis before version 1.9.47 which can lead to XSSCVE-2024-47090 · Other software · Nagvis · reported by security@checkmk.comMedium 5.1
Improper neutralization of input in Nagvis before version 1.9.47 which can lead to XSS
- Product
- Nagvis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagvis.orglists.debian.org
May 27, 2025Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injectionCVE-2024-38866 · Other software · Nagvis · reported by security@checkmk.comMedium 5.3
Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection
- Product
- Nagvis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025The "NagVis" component within Checkmk is vulnerable to remote code execution.CVE-2024-13723 · Other software · Checkmk · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9High 7.2
The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP.
- Product
- NagVis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmk.comkorelogic.com
Feb 4, 2025The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting.CVE-2024-13722 · Other software · Checkmk · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Medium 5.4
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.
- Product
- NagVis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmk.comkorelogic.com
Dec 19, 2024Improper neutralization of input in Nagvis before version 1.9.42 which can lead to XSSCVE-2024-47093 · Other software · Nagvis · reported by security@checkmk.comHigh 8.8
Improper neutralization of input in Nagvis before version 1.9.42 which can lead to XSS
- Product
- Nagvis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2023XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php.CVE-2023-46287 · Other software · Nagvis · reported by MITREMedium 6.1
XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php.
- Product
- Nagvis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php.CVE-2022-46945 · Other software · Nagvis · reported by MITRECritical 9.1
Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php.
- Product
- Nagvis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability was found in NagVis up to 1.9.33 and classified as problematic.CVE-2022-3979 · Other software · Nagvis · reported by VulDBMedium 5.6
A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type conversion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.9.34 is able to address this issue. The identifier of the patch is 7574fd8a2903282c2e0d1feef5c4876763db21d5. It is recommended to upgrade the affected component. The identifier VDB-213557 was assigned to this vulnerability.
- Product
- Nagvis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability.CVE-2021-33178 · Other software · NagVis · reported by disclosure@synopsys.comMedium 6.5
The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system.
- Product
- NagVis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagvis.orgsynopsys.com
Mar 2, 2017An issue was discovered in NagVis 1.9b12.CVE-2017-6393 · Other software · Nagvis · reported by MITREMedium 6.1
An issue was discovered in NagVis 1.9b12. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "nagvis-master/share/userfiles/gadgets/std_table.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
- Product
- Nagvis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.