Vendor
Icinga
56 known vulnerabilities in products by Icinga, 0 of them actively exploited (CISA KEV).
Key figures
56
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2022-24715 | Arbitrary code execution for authenticated users in Icinga Web 2 | 8.5 | |
| High | CVE-2022-24716 | Path traversal in Icinga Web 2 | 7.5 | |
| Critical | CVE-2024-49369 | Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections | 9.8 | |
| High | CVE-2020-24368 | Icinga Web 2: Path Traversal | 7.5 | |
| High | CVE-2026-61551 | Icinga 2: Stack overflow via deeply nested JSON objects | 8.6 | |
| Critical | CVE-2026-61550 | Icinga 2: Improper access control for JSON-RPC update certificate messages | 9.8 | |
| High | CVE-2021-32743 | Passwords used to access external services inadvertently exposed through API | 8.8 | |
| Critical | CVE-2018-18249 | Icinga Web 2: security vulnerability | 9.8 | |
| High | CVE-2026-61552 | Icinga 2 DSL Injection via Unescaped Import Template Name | 7.2 | |
| Critical | CVE-2020-29663 | Icinga: security vulnerability | 9.1 | |
| High | CVE-2018-6535 | Icinga: security vulnerability | 8.1 | |
| High | CVE-2021-32739 | Icinga2: Privilege Defined With Unsafe Actions | 8.8 | |
| High | CVE-2021-37698 | Icinga2: Improper Certificate Validation | 7.5 | |
| Not rated | CVE-2012-6096 | Nagios: Stack-Based Buffer Overflow | — | |
| High | CVE-2018-6532 | Icinga: security vulnerability | 7.5 | |
| Not rated | CVE-2013-7108 | Nagios: Buffer Over-read | — | |
| Not rated | CVE-2011-2179 | Icinga: Cross-Site Scripting (XSS) | — | |
| Medium | CVE-2015-8010 | Icinga: Cross-Site Scripting (XSS) | 6.1 | |
| Critical | CVE-2025-48057 | Icinga 2 certificate renewal might incorrectly renew an invalid certificate | 9.8 | |
| High | CVE-2018-18250 | Icinga Web 2: security vulnerability | 7.5 | |
| Medium | CVE-2021-32747 | Custom variable protection and blacklists can be circumvented | 5.3 | |
| Medium | CVE-2018-6534 | Icinga: NULL Pointer Dereference | 6.5 | |
| Medium | CVE-2021-32746 | Possible path traversal by use of the `doc` module | 5.3 | |
| High | CVE-2025-27404 | Icinga Web 2 DOM-based XSS vulnerability | 7.7 | |
| Medium | CVE-2022-24714 | Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2 | 5.3 |
Products
| Icinga | 31 | 0 |
| Icinga Web 2 | 13 | 0 |
| Icinga2 | 12 | 0 |
| Icingaweb2 | 9 | 0 |