Log in Start free

Icinga

Products

ProductCVEsExploitedLatest
icinga212–Sep 18, 2026
icingaweb29–Mar 26, 2025
icingaweb2-module-director2–Mar 26, 2025
ipl-web2–May 8, 2026
icingadb-web2–Oct 16, 2025
icingaweb2-module-incubator1–Feb 9, 2024
icingaweb2-module-jira1–Jul 5, 2023
icingaweb2-module-reporting1–Mar 26, 2025
icinga-powershell-framework1–Jan 29, 2026

Exploited and recent CVEs

  • CVE-2026-61552 High 7.2 Icinga 2 DSL Injection via Unescaped Import Template Name 0.9%
  • CVE-2026-61551 High 8.6 Icinga 2: Stack overflow via deeply nested JSON objects 0.9%
  • CVE-2026-61550 Critical 9.8 Icinga 2: Improper access control for JSON-RPC update certificate messages 0.7%
  • CVE-2026-42224 High 7.6 ipl/web is vulnerable to reflected XSS by malformed search requests 0.3%
  • CVE-2026-24414 Medium 6.8 Icinga for Windows certificate can have too-open permissions 0.1%
  • CVE-2026-24413 Medium 6.8 Icinga has insecure permission of %ProgramData%\icinga2\var on Windows <0.1%
  • CVE-2025-61909 Medium 4.0 Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user 0.2%
  • CVE-2025-61908 High 7.1 Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference 0.6%
  • CVE-2025-61907 High 7.1 Icinga 2 API users could access restricted values in filter expressions 0.4%
  • CVE-2025-61789 Medium 5.3 Icinga DB Web hidden/protected custom variables are prone to filter enumeration 0.4%
  • CVE-2025-53840 Low 2.4 Icinga DB Web Exposure of Sensitive Information to an Unauthorized Actor vulnerability 0.3%
  • CVE-2025-48057 Critical 9.3 Icinga 2 certificate renewal might incorrectly renew an invalid certificate 0.5%
  • CVE-2025-30164 Medium 4.1 Icinga Web 2 has open redirect on login page 0.3%
  • CVE-2025-27609 Low 1.1 Icinga Web 2 Vulnerable to Reflected XSS 0.3%
  • CVE-2025-27406 High 7.7 Icinga Reporting Stored XSS leads to SSRF 0.3%
  • CVE-2025-27405 High 7.7 Icinga Web 2 has XSS in embedded content 0.3%
  • CVE-2025-27404 High 7.7 Icinga Web 2 DOM-based XSS vulnerability 0.6%
  • CVE-2025-23203 Medium 5.5 Icinga has rest API endpoints accessible to restricted users 0.4%
  • CVE-2024-49369 Critical 9.8 Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections 2.9%
  • CVE-2024-41811 Low 3.9 ipl/web susceptible to Cross-Site Request Forgery (CSRF) 0.2%
  • CVE-2024-24819 Medium 5.3 icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF 0.3%
  • CVE-2024-24820 High 8.3 Icinga Director configuration is susceptible to Cross-Site Request Forgery 0.4%
  • CVE-2023-30607 Medium 5.0 icingaweb2-module-jira template and field configuration are susceptible to CSRF 0.3%
  • CVE-2022-24714 Medium 5.3 Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2 1.2%
  • CVE-2022-24715 High 8.5 Arbitrary code execution for authenticated users in Icinga Web 2 14.9%
  • CVE-2022-24716 High 7.5 Path traversal in Icinga Web 2 89.4%
  • CVE-2021-37698 High 7.5 Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer 1.4%
  • CVE-2021-32743 High 8.8 Passwords used to access external services inadvertently exposed through API 1.8%
  • CVE-2021-32739 High 8.8 Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities 1.1%
  • CVE-2021-32747 Medium 5.3 Custom variable protection and blacklists can be circumvented 1.4%