Log in Start free

Cacti

Products

ProductCVEsExploitedLatest
Cacti681Oct 23, 2026

Exploited and recent CVEs

  • CVE-2022-46169 Critical 9.8 Exploited Unauthenticated Command Injection 99.8%
  • CVE-2026-49442 Medium 5.3 Cacti: User Enumeration via Error Messages 0.2%
  • CVE-2026-39902 High 7.2 Cacti: Authenticated RCE on Data Input 0.4%
  • CVE-2026-46531 Medium 5.5 Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368) 0.3%
  • CVE-2026-71287 High 8.8 Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection 0.5%
  • CVE-2026-40941 High 7.1 Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages 0.3%
  • CVE-2026-40084 Medium 6.5 Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter 0.5%
  • CVE-2026-40083 High 7.2 Cacti: SQL Injection in managers.php 0.5%
  • CVE-2026-40082 Medium 5.4 Cacti: Session Fixation via missing session_regenerate_id() after login 0.3%
  • CVE-2026-40080 Medium 6.1 Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect 0.3%
  • CVE-2026-40079 High 8.6 Cacti: Command Injection via escape_command() no-op in RRDtool execution 1.7%
  • CVE-2026-39951 High 7.6 Cacti: Stored SQL Injection via graph_name_regexp in Reports feature 0.4%
  • CVE-2026-39948 Critical 9.3 Cacti has SQL Injection via rfilter parameter in RLIKE clauses 0.8%
  • CVE-2026-39955 Critical 9.8 Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php 0.6%
  • CVE-2026-39938 Critical 9.8 Cacti: Unauthenticated RCE on Graph Image 0.7%
  • CVE-2026-39900 Medium 5.3 Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript context 0.3%
  • CVE-2026-39899 Medium 6.9 Cacti: Path Traversal via filename parameter in package_import.php 0.4%
  • CVE-2026-39897 Medium 5.3 Cacti has a Reflected XSS Vulnerability via html_auth_footer 0.3%
  • CVE-2026-39894 Low 2.9 Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting 0.1%
  • CVE-2026-39893 Critical 9.8 Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php 0.7%
  • CVE-2025-66399 High 7.4 SNMP Command Injection leads to RCE in Cacti 10.8%
  • CVE-2025-26520 High 7.6 Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue exists because of an incomplete fix for CVE-2024-54146. 0.5%
  • CVE-2025-24368 Medium 6.9 Cacti has a SQL Injection vulnerability when using tree rules through Automation API 0.5%
  • CVE-2025-24367 High 8.7 Cacti allows Arbitrary File Creation leading to RCE 58.8%
  • CVE-2025-22604 Critical 9.1 Cacti has Authenticated RCE via multi-line SNMP responses 5.3%
  • CVE-2024-54145 Medium 6.3 Cacti has a SQL Injection vulnerability when request automation devices 0.7%
  • CVE-2024-54146 High 7.6 Cacti has a SQL Injection vulnerability when view host template 45.9%
  • CVE-2024-45598 Medium 6.0 Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path 3.0%
  • CVE-2024-43363 High 7.2 Remote code execution via Log Poisoning in Cacti 35.6%
  • CVE-2024-43365 Medium 5.7 Stored Cross-site Scripting (XSS) when creating external links in Cacti 25.1%