nezhahq nezha
30 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-120046 | 2.0.0 – < 2.4.0 | Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-111387 | 2.2.5 – < 2.3.15 | Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint | HIGH 7.1 | 0.3 % | ||
| CVE-2026-111386 | 1.7.0 – < 2.3.15 | Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-111385 | 2.1.0 – < 2.3.15 | Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-111384 | 1.0.0 – < 2.3.15 | Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket | HIGH 7.1 | 0.4 % | ||
| CVE-2026-111383 | 2.0.13 – < 2.3.15 | Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket | HIGH 7.1 | 0.4 % | ||
| CVE-2026-100394 | >= 2.2.7, < 2.2.11 | Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-105113 | 1.8.0 – < 2.3.13 | Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock | HIGH 7.1 | 0.2 % | ||
| CVE-2026-105112 | 1.8.0 – < 2.3.13 | Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-101090 | 2.2.3 | Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-101089 | < 2.2.7 | Nezha before 2.2.7 Information Disclosure via /api/v1/profile | LOW 2.3 | 0.2 % | ||
| CVE-2026-101088 | 2.2.11 – < 2.3.1 | Nezha before 2.3.1 Denial of Service via Concurrent Server Delete | MEDIUM 6.0 | 0.2 % | ||
| CVE-2026-101087 | 2.0.10 – < 2.3.3 | Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-101086 | < 2.3.5 | Nezha Dashboard before 2.3.5 Task Type Validation Bypass | HIGH 7.1 | 0.3 % | ||
| CVE-2026-101085 | < 2.3.8 | Nezha before 2.3.8 Denial of Service via Alert Rule | HIGH 7.1 | 0.3 % | ||
| CVE-2026-62283 | >= 1.14.13, <= 1.14.14 ; >= 2.0.0, < 2.0.10 | Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-59155 | < 2.2.5 | Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-53523 | >= 1.0.0, < 2.2.0 | Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-53522 | >= 1.0.0, < 2.2.0 | Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-53521 | >= 2.0.14, < 2.1.0 | Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-53520 | >= 2.0.14, < 2.1.0 | Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-53519 | < 2.0.13 | Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key | CRITICAL 9.1 | 1.9 % | ||
| CVE-2026-49397 | >= 2.0.0, < 2.0.14 | Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-49396 | >= 1.0.0, < 2.0.14 | Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents | HIGH 7.1 | 0.1 % | ||
| CVE-2026-48119 | >= 0.20.0, < 2.0.12 | Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services | HIGH 7.1 | 0.3 % | ||
| CVE-2026-47124 | >= 1.4.0, < 2.0.9 | Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-47120 | >= 1.4.0, < 2.0.8 | Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) | HIGH 7.1 | 0.3 % | ||
| CVE-2026-46717 | >= 1.4.0, < 2.0.8 | Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification | HIGH 7.7 | 0.3 % | ||
| CVE-2026-46716 | >= 1.4.0, < 2.0.8 | Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron | CRITICAL 9.9 | 0.4 % | ||
| CVE-2026-47268 | >= 0.20.0, < 2.0.10 | Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host | MEDIUM 6.4 | 0.2 % |