CVE-2026-49396

7.1 HIGH

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool

Published: 2026-06-12 · Last updated: 2026-06-13

Severity and scoring

CVSS: 7.1 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
CWE: CWE-352

Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14.

Source: NVD

References

Related CVEs

Same CWE

CVE-2026-54359 — MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled
CVE-2026-48612 — Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’... (8.0 HIGH)
CVE-2022-47150 — Cross-Site request forgery (CSRF) vulnerability in weDevs WooCommerce Conversion Tracking allows Cross Site Request Forgery (4.3 MEDIUM)
CVE-2022-44630 — Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery (4.6 MEDIUM)
CVE-2024-32110 — Cross-Site request forgery (CSRF) vulnerability in Magepeople inc (4.3 MEDIUM)