Log in Start free

nezhahq

Products

ProductCVEsExploitedLatest
nezha30–Oct 30, 2026

Exploited and recent CVEs

  • CVE-2026-120046 Medium 5.3 Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History 0.3%
  • CVE-2026-111387 Medium 6.5 Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint 0.3%
  • CVE-2026-111386 Medium 4.3 Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig 0.2%
  • CVE-2026-111385 Medium 4.8 Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools 0.2%
  • CVE-2026-111384 Medium 6.5 Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket 0.4%
  • CVE-2026-111383 Medium 6.5 Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket 0.4%
  • CVE-2026-100394 Medium 6.5 Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant 0.5%
  • CVE-2026-105113 Medium 6.5 Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock 0.2%
  • CVE-2026-105112 Medium 5.3 Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints 0.2%
  • CVE-2026-101090 Critical 9.8 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri 0.4%
  • CVE-2026-101089 Low 3.1 Nezha before 2.2.7 Information Disclosure via /api/v1/profile 0.2%
  • CVE-2026-101088 Medium 5.3 Nezha before 2.3.1 Denial of Service via Concurrent Server Delete 0.2%
  • CVE-2026-101087 Medium 4.3 Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 0.3%
  • CVE-2026-101086 Medium 6.5 Nezha Dashboard before 2.3.5 Task Type Validation Bypass 0.3%
  • CVE-2026-101085 Medium 6.5 Nezha before 2.3.8 Denial of Service via Alert Rule 0.3%
  • CVE-2026-62283 Critical 9.9 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check 0.6%
  • CVE-2026-59155 Medium 6.9 Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API 0.4%
  • CVE-2026-53523 Medium 6.8 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection 0.3%
  • CVE-2026-53522 Medium 6.5 Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS 0.3%
  • CVE-2026-53521 Medium 6.4 Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context 0.3%
  • CVE-2026-53520 Medium 6.5 Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing 0.3%
  • CVE-2026-53519 Critical 9.1 Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key 1.9%
  • CVE-2026-49397 Medium 5.3 Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data 0.3%
  • CVE-2026-49396 High 7.1 Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents 0.1%
  • CVE-2026-48119 High 7.1 Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services 0.3%
  • CVE-2026-47124 Medium 6.5 Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members 0.3%
  • CVE-2026-47120 High 7.1 Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) 0.3%
  • CVE-2026-46717 High 7.7 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification 0.3%
  • CVE-2026-46716 Critical 9.9 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron 0.4%
  • CVE-2026-47268 Medium 6.4 Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host 0.2%