Cacti Cacti

• CVE-2022-46169 Critical 9.8 Exploited Unauthenticated Command Injection 99.8%
• CVE-2026-49442 Medium 5.3 Cacti: User Enumeration via Error Messages 0.2%
• CVE-2026-39902 High 7.2 Cacti: Authenticated RCE on Data Input 0.4%
• CVE-2026-46531 Medium 5.5 Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368) 0.3%
• CVE-2026-71287 High 8.8 Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection 0.5%
• CVE-2026-40941 High 7.1 Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages 0.3%
• CVE-2026-40084 Medium 6.5 Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter 0.5%
• CVE-2026-40083 High 7.2 Cacti: SQL Injection in managers.php 0.5%
• CVE-2026-40082 Medium 5.4 Cacti: Session Fixation via missing session_regenerate_id() after login 0.3%
• CVE-2026-40080 Medium 6.1 Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect 0.3%
• CVE-2026-40079 High 8.6 Cacti: Command Injection via escape_command() no-op in RRDtool execution 1.7%
• CVE-2026-39951 High 7.6 Cacti: Stored SQL Injection via graph_name_regexp in Reports feature 0.4%
• CVE-2026-39948 Critical 9.3 Cacti has SQL Injection via rfilter parameter in RLIKE clauses 0.8%
• CVE-2026-39955 Critical 9.8 Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php 0.6%
• CVE-2026-39938 Critical 9.8 Cacti: Unauthenticated RCE on Graph Image 0.7%
• CVE-2026-39900 Medium 5.3 Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript context 0.3%
• CVE-2026-39899 Medium 6.9 Cacti: Path Traversal via filename parameter in package_import.php 0.4%
• CVE-2026-39897 Medium 5.3 Cacti has a Reflected XSS Vulnerability via html_auth_footer 0.3%
• CVE-2026-39894 Low 2.9 Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting 0.1%
• CVE-2026-39893 Critical 9.8 Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php 0.7%
• CVE-2025-66399 High 7.4 SNMP Command Injection leads to RCE in Cacti 10.8%
• CVE-2025-26520 High 7.6 Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue exists because of an incomplete fix for CVE-2024-54146. 0.5%
• CVE-2025-24368 Medium 6.9 Cacti has a SQL Injection vulnerability when using tree rules through Automation API 0.5%
• CVE-2025-24367 High 8.7 Cacti allows Arbitrary File Creation leading to RCE 58.8%
• CVE-2025-22604 Critical 9.1 Cacti has Authenticated RCE via multi-line SNMP responses 5.3%
• CVE-2024-54145 Medium 6.3 Cacti has a SQL Injection vulnerability when request automation devices 0.7%
• CVE-2024-54146 High 7.6 Cacti has a SQL Injection vulnerability when view host template 45.9%
• CVE-2024-45598 Medium 6.0 Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path 3.0%
• CVE-2024-43363 High 7.2 Remote code execution via Log Poisoning in Cacti 35.6%
• CVE-2024-43365 Medium 5.7 Stored Cross-site Scripting (XSS) when creating external links in Cacti 25.1%
• CVE-2024-43364 Medium 5.7 Stored Cross-site Scripting (XSS) when creating external links in Cacti 37.9%
• CVE-2024-43362 High 7.3 Stored Cross-site Scripting (XSS) when creating external links in Cacti 38.6%
• CVE-2024-34340 Critical 9.1 Authentication Bypass when using using older password hashes 1.1%
• CVE-2024-31460 Medium 6.5 Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database 1.8%
• CVE-2024-31459 High 8.1 Cacti RCE vulnerability by file include in lib/plugin.php 2.7%
• CVE-2024-31458 Medium 4.6 Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database 12.6%
• CVE-2024-31445 High 8.8 SQL Injection vulnerability in automation_get_new_graphs_sql 26.2%
• CVE-2024-31444 Medium 4.6 Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database 14.7%
• CVE-2024-31443 Medium 5.7 Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database 0.8%
• CVE-2024-30268 Medium 6.1 Cacti XSS vulnerability in display_settings 0.6%
• CVE-2024-29895 Critical 10.0 Cacti command injection in cmd_realtime.php 98.8%
• CVE-2024-29894 Medium 5.4 Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API 0.9%
• CVE-2024-27082 High 7.6 Cacti Cross-site Scripting vulnerability when managing trees 0.9%
• CVE-2024-25641 Critical 9.1 Cacti RCE vulnerability when importing packages 86.3%
• CVE-2023-51448 High 8.8 SQL Injection vulnerability when managing SNMP Notification Receivers 67.3%
• CVE-2023-50250 Medium 5.4 Cross-Site Scripting vulnerability when Import xml template file 1.3%
• CVE-2023-49088 Medium 6.1 Cacti has incomplete fix for CVE-2023-39515 1.3%
• CVE-2023-49085 High 8.8 Cacti SQL Injection vulnerability 74.5%
• CVE-2023-49086 Medium 5.4 Cacti is vulnerable to cross-Site scripting (XSS) DOM 1.5%
• CVE-2023-49084 High 8.1 Local File Inclusion (RCE) in Cacti 64.4%