Centreon vulnerabilities

CVEs per yearBy the year they were published

1. 20121
2. 20222
3. 20237
4. 20249
5. 202522
6. 202614

Newest CVEs

• CVE-2026-11587

  Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0

  Centreon · Centreon

  High7.2
• CVE-2025-12523

  Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure

  Centreon · Centreon

  Medium6.5
• CVE-2025-13050

  Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users

  Centreon · Centreon

  Medium5.4
• CVE-2026-14453

  A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets

  Centreon · Infra Monitoring

  Critical9.6
• CVE-2026-2749

  Path traversal in Centreon Open Tickets

  Centreon · Centreon Open Tickets on Central Server

  Critical9.9
• CVE-2026-2750

  Command Injection via CLAPI generatetraps

  Centreon · Centreon Open Tickets on Central Server

  Critical9.1
• CVE-2026-2751

  Blind SQL Injection

  Centreon · Centreon Web on Central Server

  High8.3
• CVE-2025-15029

  An unauthenticated user is able to introduce SQL Injection using the Awie export module

  Centreon · Infra Monitoring

  Critical9.8
• CVE-2025-15026

  Unauthenticated configuration import allows administrative account creation using AWIE component

  Centreon · Infra Monitoring

  Critical9.8
• CVE-2025-12511

  A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page

  Centreon · Infra Monitoring

  Medium6.8