Icinga vulnerabilities

CVEs per yearBy the year they were published

1. 20215
2. 20223
3. 20231
4. 20244
5. 202512
6. 20266

Newest CVEs

• CVE-2026-61552

  Icinga 2 DSL Injection via Unescaped Import Template Name

  Icinga · icinga2

  High7.2
• CVE-2026-61551

  Icinga 2: Stack overflow via deeply nested JSON objects

  Icinga · icinga2

  High8.6
• CVE-2026-61550

  Icinga 2: Improper access control for JSON-RPC update certificate messages

  Icinga · icinga2

  Critical9.8
• CVE-2026-42224

  ipl/web is vulnerable to reflected XSS by malformed search requests

  Icinga · ipl-web

  High7.6
• CVE-2026-24414

  Icinga for Windows certificate can have too-open permissions

  Icinga · icinga-powershell-framework

  Medium6.8
• CVE-2026-24413

  Icinga has insecure permission of %ProgramData%\icinga2\var on Windows

  Icinga · icinga2

  Medium6.8
• CVE-2025-61909

  Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon user

  Icinga · icinga2

  Medium4.0
• CVE-2025-61908

  Icinga 2 Denial of Service (DoS) By Dereferencing Invalid Reference

  Icinga · icinga2

  High7.1
• CVE-2025-61907

  Icinga 2 API users could access restricted values in filter expressions

  Icinga · icinga2

  High7.1
• CVE-2025-61789

  Icinga DB Web hidden/protected custom variables are prone to filter enumeration

  Icinga · icingadb-web

  Medium5.3