[ Vendor · 14 CVEs ]
nezhahq
CVEs affecting nezhahq published in the last 30 days, plus any nezhahq CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111386 | 16 Oct 2026 | CVSS 4.3 | nezhahq nezhaNezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server… | |
| CVE-2026-111387 | 16 Oct 2026 | CVSS 6.5 | nezhahq nezhaNezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials… | |
| CVE-2026-111383 | 16 Oct 2026 | CVSS 6.5 | nezhahq nezhaNezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections… | |
| CVE-2026-111384 | 16 Oct 2026 | CVSS 6.5 | nezhahq nezhaNezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls… | |
| CVE-2026-111385 | 16 Oct 2026 | CVSS 4.8 | nezhahq nezhaNezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url… | |
| CVE-2026-100394 | 14 Oct 2026 | CVSS 6.5 | Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantNezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in… | Fix |
| CVE-2026-105112 | 3 Oct 2026 | CVSS 5.3 | nezhahq nezhaNezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock… | |
| CVE-2026-105113 | 3 Oct 2026 | CVSS 6.5 | nezhahq nezhaNezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path… | |
| CVE-2026-101090 | 27 Sep 2026 | CVSS 9.8 | nezhahq nezhaNezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty… | |
| CVE-2026-101085 | 27 Sep 2026 | CVSS 6.5 | nezhahq nezhaNezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules… | |
| CVE-2026-101086 | 27 Sep 2026 | CVSS 6.5 | nezhahq nezhaNezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with… | |
| CVE-2026-101087 | 27 Sep 2026 | CVSS 4.3 | nezhahq nezhaNezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist… | |
| CVE-2026-101088 | 27 Sep 2026 | CVSS 5.3 | nezhahq nezhaNezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/singleton/servicesentinel.go)… | |
| CVE-2026-101089 | 27 Sep 2026 | CVSS 3.1 | nezhahq nezhaNezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field… |