Icinga
- Total products in the ecosystem
- 9
- Total vulnerabilities (90 days)
- 3
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 09/20/2026, Icinga recorded 3 security vulnerabilities in the last 90 days across 1 products, including 3 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, icinga2 had the most security vulnerabilities in the Icinga ecosystem, with 3 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-61552Icinga 2 DSL Injection via Unescaped Import Template Name | Exploitation statusNot known exploited | FixYes | Affected producticinga2 | Published09/18/2026 | SeverityHigh |
CVE-2026-61551Icinga 2: Stack overflow via deeply nested JSON objects | Exploitation statusNot confirmed | FixYes | Affected producticinga2 | Published09/18/2026 | SeverityHigh |
CVE-2026-61550Icinga 2: Improper access control for JSON-RPC update certificate messages | Exploitation statusNot confirmed | FixYes | Affected producticinga2 | Published09/18/2026 | SeverityCritical |
CVE-2026-42224ipl/web is vulnerable to reflected XSS by malformed search requests | Exploitation statusNot known exploited | FixYes | Affected productipl-web | Published05/08/2026 | SeverityHigh |
CVE-2026-24414Icinga for Windows certificate can have too-open permissions | Exploitation statusNot known exploited | FixNot confirmed | Affected producticinga-powershell-framework | Published01/29/2026 | SeverityMedium |
CVE-2026-24413Icinga has insecure permission of %ProgramData%\icinga2\var on Windows | Exploitation statusNot known exploited | FixNot confirmed | Affected producticinga2 | Published01/29/2026 | SeverityMedium |
CVE-2025-61909Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user | Exploitation statusNot known exploited | FixNot confirmed | Affected producticinga2 | Published10/16/2025 | SeverityMedium |
CVE-2025-61908Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference | Exploitation statusNot known exploited | FixNot confirmed | Affected producticinga2 | Published10/16/2025 | SeverityHigh |
CVE-2025-61907Icinga 2 API users could access restricted values in filter expressions | Exploitation statusNot known exploited | FixYes | Affected producticinga2 | Published10/16/2025 | SeverityHigh |
CVE-2025-61789Icinga DB Web hidden/protected custom variables are prone to filter enumeration | Exploitation statusNot known exploited | FixNot confirmed | Affected producticingadb-web | Published10/16/2025 | SeverityMedium |
CVE-2025-53840Icinga DB Web Exposure of Sensitive Information to an Unauthorized Actor vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected producticingadb-web | Published07/16/2025 | SeverityLow |
CVE-2025-48057Icinga 2 certificate renewal might incorrectly renew an invalid certificate | Exploitation statusNot known exploited | FixYes | Affected producticinga2 | Published05/27/2025 | SeverityCritical |
CVE-2025-30164Icinga Web 2 has open redirect on login page | Exploitation statusNot known exploited | FixYes | Affected producticingaweb2 | Published03/26/2025 | SeverityMedium |
CVE-2025-27609Icinga Web 2 Vulnerable to Reflected XSS | Exploitation statusNot known exploited | FixYes | Affected producticingaweb2 | Published03/26/2025 | SeverityLow |
CVE-2025-27406Icinga Reporting Stored XSS leads to SSRF | Exploitation statusNot known exploited | FixYes | Affected producticingaweb2-module-reporting | Published03/26/2025 | SeverityHigh |
CVE-2025-27405Icinga Web 2 has XSS in embedded content | Exploitation statusNot known exploited | FixYes | Affected producticingaweb2 | Published03/26/2025 | SeverityHigh |
CVE-2025-27404Icinga Web 2 DOM-based XSS vulnerability | Exploitation statusNot known exploited | FixYes | Affected producticingaweb2 | Published03/26/2025 | SeverityHigh |
CVE-2025-23203Icinga has rest API endpoints accessible to restricted users | Exploitation statusNot known exploited | FixNot confirmed | Affected producticingaweb2-module-director | Published03/26/2025 | SeverityMedium |
CVE-2024-49369Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections | Exploitation statusNot known exploited | FixYes | Affected producticinga2 | Published11/12/2024 | SeverityCritical |
CVE-2024-41811ipl/web susceptible to Cross-Site Request Forgery (CSRF) | Exploitation statusNot known exploited | FixNot confirmed | Affected productipl-web | Published08/05/2024 | SeverityLow |
CVE-2024-24819icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF | Exploitation statusNot known exploited | FixNot confirmed | Affected producticingaweb2-module-incubator | Published02/09/2024 | SeverityMedium |
CVE-2024-24820Icinga Director configuration is susceptible to Cross-Site Request Forgery | Exploitation statusPublic exploit | FixNot confirmed | Affected producticingaweb2-module-director | Published02/09/2024 | SeverityHigh |
CVE-2023-30607icingaweb2-module-jira template and field configuration are susceptible to CSRF | Exploitation statusNot known exploited | FixYes | Affected producticingaweb2-module-jira | Published07/05/2023 | SeverityMedium |
CVE-2022-24714Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2 | Exploitation statusNot known exploited | FixYes | Affected producticingaweb2 | Published03/08/2022 | SeverityMedium |
CVE-2022-24716Path traversal in Icinga Web 2 | Exploitation statusNot known exploited | FixYes | Affected producticingaweb2 | Published03/08/2022 | SeverityHigh |
CVE-2022-24715Arbitrary code execution for authenticated users in Icinga Web 2 | Exploitation statusNot known exploited | FixYes | Affected producticingaweb2 | Published03/08/2022 | SeverityHigh |
CVE-2021-37698Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer | Exploitation statusNot confirmed | FixNot confirmed | Affected producticinga2 | Published08/19/2021 | SeverityHigh |
CVE-2021-32743Passwords used to access external services inadvertently exposed through API | Exploitation statusNot confirmed | FixNot confirmed | Affected producticinga2 | Published07/15/2021 | SeverityHigh |
CVE-2021-32739Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities | Exploitation statusNot confirmed | FixNot confirmed | Affected producticinga2 | Published07/15/2021 | SeverityHigh |
CVE-2021-32747Custom variable protection and blacklists can be circumvented | Exploitation statusNot confirmed | FixYes | Affected producticingaweb2 | Published07/12/2021 | SeverityMedium |
CVE-2021-32746Possible path traversal by use of the `doc` module | Exploitation statusNot confirmed | FixYes | Affected producticingaweb2 | Published07/12/2021 | SeverityMedium |
CVE-2020-29663 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published12/15/2020 | SeverityUnknown |
CVE-2020-24368 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published08/19/2020 | SeverityUnknown |
CVE-2020-14004 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/12/2020 | SeverityUnknown |
CVE-2018-18246 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/17/2018 | SeverityUnknown |
CVE-2018-18248 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/17/2018 | SeverityUnknown |
CVE-2018-18249 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/17/2018 | SeverityUnknown |
CVE-2018-18247 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/17/2018 | SeverityUnknown |
CVE-2018-18250 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/17/2018 | SeverityUnknown |
CVE-2018-6535 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/27/2018 | SeverityUnknown |
CVE-2018-6532 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/27/2018 | SeverityUnknown |
CVE-2018-6533 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published02/27/2018 | SeverityUnknown |
CVE-2018-6534 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/27/2018 | SeverityUnknown |
CVE-2018-6536 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/02/2018 | SeverityUnknown |
CVE-2017-16933 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/24/2017 | SeverityUnknown |
CVE-2017-16882 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/18/2017 | SeverityUnknown |
CVE-2015-8010 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/27/2017 | SeverityUnknown |
CVE-2014-2386 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/25/2014 | SeverityUnknown |
CVE-2014-1878 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/28/2014 | SeverityUnknown |
CVE-2013-7108 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/14/2014 | SeverityUnknown |
CVE-2013-7107 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/14/2014 | SeverityUnknown |
CVE-2013-7106 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/14/2014 | SeverityUnknown |
CVE-2012-6096 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/22/2013 | SeverityUnknown |
CVE-2012-3441 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/25/2012 | SeverityUnknown |
CVE-2011-2179 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/14/2011 | SeverityUnknown |
CVE-2011-2477 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/14/2011 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
