Product by Nezhahq

    Nezha

    29 known vulnerabilities in Nezha (Nezhahq), 0 of them actively exploited (CISA KEV).

    Key figures

    29

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Nezha (Nezhahq)
    CriticalCVE-2026-53519

    Nezha: Path Traversal

    also in 1 other product

    		9.1
    CriticalCVE-2026-101090

    Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

    also in 1 other product

    		9.8
    CriticalCVE-2026-62283

    Nezha: Authorization Bypass Through User-Controlled Key

    also in 1 other product

    		9.9
    CriticalCVE-2026-46716

    Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

    also in 1 other product

    		9.9
    MediumCVE-2026-100394

    Nezha: NULL Pointer Dereference

    also in 1 other product

    		6.5
    HighCVE-2026-111384

    Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

    		6.5
    HighCVE-2026-111383

    Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

    		6.5
    HighCVE-2026-101086

    Nezha Dashboard before 2.3.5 Task Type Validation Bypass

    		6.5
    HighCVE-2026-101085

    Nezha before 2.3.8 Denial of Service via Alert Rule

    		6.5
    HighCVE-2026-111387

    Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint

    		6.5
    HighCVE-2026-105113

    Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock

    		6.5
    MediumCVE-2026-59155

    Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API

    also in 1 other product

    		—
    MediumCVE-2026-111385

    Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

    		4.8
    HighCVE-2026-46717

    Nezha: Server-Side Request Forgery (SSRF)

    also in 1 other product

    		7.7
    MediumCVE-2026-105112

    Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints

    		5.3
    MediumCVE-2026-101088

    Nezha before 2.3.1 Denial of Service via Concurrent Server Delete

    		5.3
    HighCVE-2026-47120

    Nezha: Missing Authorization

    also in 1 other product

    		7.1
    HighCVE-2026-48119

    Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services

    also in 1 other product

    		7.1
    MediumCVE-2026-101087

    Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6

    		4.3
    MediumCVE-2026-53522

    Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS

    also in 1 other product

    		6.5
    MediumCVE-2026-111386

    Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig

    		4.3
    MediumCVE-2026-53520

    Nezha: Improper Access Control

    also in 1 other product

    		6.5
    MediumCVE-2026-47124

    Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members

    also in 1 other product

    		6.5
    MediumCVE-2026-53523

    Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

    also in 1 other product

    		6.8
    HighCVE-2026-49396

    Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents

    also in 1 other product

    		7.1

    All vulnerabilities in search

    News

    All products by Nezhahq