Reserved but Public CVEs

Nagios XI before 5.11.4 stored sensitive credentials and tokens in plaintext in the `xi_options` database table. According to the provided context, this affected credentials supplied in Inbound/Outbound Transfer settings and exposed NRDP, NSCA, SMTP, and related transfer credentials without encryption or adequate protection at rest. The issue is an insecure storage flaw in which application secrets that should be protected were persisted directly in database records in recoverable plaintext form.

CVE-2023-47402First seen May 31, 2026

CVE-2023-47400 is a high-severity remote code execution vulnerability in the Nagios XI Custom Includes feature affecting Nagios XI v5.11.1. According to the provided context, the protection model for Custom Includes could be bypassed by overwriting or removing the .htaccess file that was intended to prevent execution of uploaded content, and then uploading a PHP payload disguised with an allowed filename or extension pattern such as "exploit.jpg.php". Once the uploaded file was reachable over the web interface, the attacker could request it directly and cause the embedded PHP code to execute on the Nagios XI server. The issue is therefore an unrestricted or insufficiently restricted file upload condition combined with ineffective server-side execution controls in the upload location.

CVE-2023-47400First seen May 31, 2026

CVE-2023-47401 is a critical remote code execution vulnerability in Nagios XI, affecting the migration feature in versions including 5.11.1. According to the provided content, the migration page at /nagiosxi/admin/migrate.php passes attacker-supplied IP address, username, and password values to a PHP migration script executed via sudo as root. A high-privileged attacker can inject attacker-controlled Ansible playbook or vault content into this workflow. Because the injected YAML can invoke Ansible functionality such as lookup("pipe", ...), arbitrary shell commands can be executed on the Nagios XI server with root privileges. The issue is described as an Ansible vault file injection flaw in the migration feature and was mitigated in Nagios XI 5.11.4.

CVE-2023-47401First seen May 31, 2026

CVE-2023-47411 is a destructive vulnerability in Nagios XI affecting the backup_xi.sh backup script. According to the provided context, the flaw is caused by unsafe handling of attacker-controlled name and directory parameters in backup_xi.sh. An attacker who can control inputs passed to this script can influence the path operated on by a root-executed recursive deletion routine, resulting in behavior described as directly equivalent to executing `rm -rf /`. The issue therefore allows attacker-influenced filesystem path control in a privileged maintenance script, turning a backup-related operation into arbitrary recursive deletion of filesystem content as root. The advisory context states this issue was mitigated in Nagios XI version 5.11.4.

CVE-2023-47411First seen May 31, 2026

CVE-2023-47412 is an authorization flaw in the Nagios XI usermacros component affecting Nagios XI v5.11.1. According to the provided advisory context, any authenticated user could send crafted HTTP requests directly to the usermacros endpoint to access functionality intended to manage user and system macros. The issue allowed low-privileged authenticated users to view or modify user macros and system macros without proper privilege enforcement. The advisory further states that an authenticated user could overwrite the /usr/local/nagios/etc/resource.cfg macros file through these requests. Where macro redaction was disabled, sensitive macro values could also be disclosed directly.

CVE-2023-47412First seen May 31, 2026

CVE-2023-47410 is a stored cross-site scripting vulnerability in Nagios XI, affecting the admin user management page in versions including 5.11.1. According to the provided context, the flaw is caused by unsafe concatenation/insertion of usernames into inline JavaScript in the Manage Users / Admin’s User Management interface. A malicious username containing JavaScript can be stored by the application and later rendered in the administrative page without proper output encoding, causing the payload to execute in the victim administrator’s browser when the page is viewed. The issue was mitigated by Nagios in version 5.11.4.

CVE-2023-47410First seen May 31, 2026

CVE-2023-47409 affects Nagios XI's migration process. Migration job files stored encrypted Ansible vault data containing credentials for remote hosts, but the vault passwords were generated predictably using PHP uniqid(). The advisory states that these encrypted migration job files were not deleted after completion, allowing an attacker with local root access on the Nagios XI server to recover the files and brute-force the vault passwords offline. Successful recovery exposes privileged credentials for remote machines involved in migration operations.

CVE-2023-47409First seen May 31, 2026

CVE-2023-47414 is a local privilege escalation vulnerability in Nagios XI, affecting the send_to_nls.php functionality that generates rsyslog configuration files. According to the provided content, attacker-controlled input was not sanitized before being written into new rsyslog configuration content. This allowed a local attacker to inject arbitrary rsyslog directives, including omprog, into generated rsyslog files. Because rsyslog would subsequently process that injected configuration, the attacker could cause execution of attacker-controlled commands in the security context of the syslog user. The issue was reported in Nagios XI v5.11.1 and was mitigated in Nagios XI v5.11.4.

CVE-2023-47414First seen May 31, 2026

CVE-2023-47406 is an information disclosure issue in Nagios XI affecting the Scheduled Backups FTP connectivity test functionality. According to the provided context, the feature exhibits a discrepancy in error-message timing depending on whether a target port is open or closed. An attacker can abuse these timing differences to infer port state and perform time-based port scanning against the Nagios XI server itself, including localhost, and potentially internal network hosts reachable from the server. The issue was reported in Nagios XI v5.11.1 and was mitigated in version 5.11.4.

CVE-2023-47406First seen May 31, 2026

CVE-2023-47407 is an information exposure vulnerability in Nagios XI affecting at least version 5.11.1. Sensitive files on the Nagios XI host were readable by all local users. Specifically, /usr/local/nagiosxi/html/config.inc.php contained plaintext database credentials and was world-readable, and /usr/local/nagiosxi/etc/htpasswd.users was also world-readable and exposed SHA1 password hashes for Nagios XI accounts. The issue is caused by overly permissive filesystem permissions on credential-bearing files, allowing unauthorized local users to read secrets that should be restricted to privileged service accounts or administrators.

CVE-2023-47407First seen May 31, 2026

Nagios XI before 5.11.4 contains an arbitrary file editing issue in the Graph Templates editor. According to the provided advisory context, an administrator using the Graph Editor/Graph Templates page could edit unintended files in the parent directory, including PHP files such as index.php, ajax.php, and zoom.php. The flaw stems from insufficient restriction of file paths accessible through the editor, allowing modification of files outside the intended template scope.

CVE-2023-47413First seen May 31, 2026

CVE-2023-47408 is a high-severity command injection vulnerability in the Nagios XI Host Configuration page affecting Nagios XI v5.11.1. According to the provided context, an administrator can inject commands on the Nagios XI server by entering shell commands surrounded by backticks into host/service argument input fields such as $ARG1$ and $ARG2$. The flaw is described as occurring in the Host Configuration workflow, where attacker-controlled argument values are later processed in a way that results in command execution on the Nagios server.

CVE-2023-47408First seen May 31, 2026

CVE-2023-47403 is an authorization flaw in Nagios XI affecting the Missing Objects page. According to the provided context, the page and its associated functionality were accessible to all authenticated users, regardless of whether they held administrator privileges. This indicates missing authorization checks on functionality intended to be restricted to administrators. As a result, a low-privileged authenticated user could access the Missing Objects page and perform actions reserved for administrative users.

CVE-2023-47403First seen May 31, 2026

CVE-2026-40710 is a use of hard-coded credentials vulnerability in Dell Container Storage Modules. According to the provided advisory context, default authentication credentials were exposed in public source code, allowing an attacker who knows or can obtain those credentials to authenticate to affected components. The issue stems from embedded default credentials rather than environment-specific secrets management, creating a condition where unauthorized parties can access sensitive system components.

CVE-2026-40710First seen May 28, 2026

First seen May 5, 2026

First seen May 3, 2026

CVE-2026-35333 is a vulnerability in libradius affecting the processing of RADIUS attributes. According to the provided context, malformed or otherwise crafted RADIUS attributes can trigger either an infinite loop condition or an out-of-bounds read during attribute parsing. The out-of-bounds read may lead to process instability or a crash. Specific vulnerable functions, affected versions, and protocol field details are not available in the provided information.

CVE-2026-35333First seen Apr 22, 2026

CVE-2026-35332 is a vulnerability in libtls affecting processing of ECDH public values in TLS versions prior to 1.3. Based on the available context, malformed or otherwise problematic ECDH public values during the handshake can trigger a crash in the library. Specific vulnerable functions, root cause details, and affected version ranges beyond TLS < 1.3 are not available in the provided content.

CVE-2026-35332First seen Apr 22, 2026

A vulnerability in libstrongswan, specifically involving the pkcs7 plugin, is related to the processing of encrypted PKCS#7 containers. Based on the provided context, malformed or otherwise problematic encrypted PKCS#7 input can trigger a crash during parsing or handling. No further verified details about the exact vulnerable function, root cause, or affected versions were provided in the available content.

CVE-2026-35329First seen Apr 22, 2026

A vulnerability exists in a constraints plugin in the processing of X.509 name constraints. According to the provided context, the plugin can incorrectly accept certificates that violate configured or expected name constraints, resulting in improper certificate validation during authentication. Specific vulnerable functions, affected product/version information, and implementation details are not available in the provided content.

CVE-2026-35331First seen Apr 22, 2026

Available information indicates a vulnerability in the gmp plugin related to RSA decryption that can result in a crash. No further technical details about the affected product, vulnerable code path, root cause, or trigger conditions are currently available from the provided context.

CVE-2026-35334First seen Apr 22, 2026

First seen Apr 22, 2026

CVE-2024-1837First seen Apr 11, 2026

CVE-2021-35400 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/mesh.cgi CGI handler, specifically the code path reached when the HTTP query parameter page=extender is supplied. In get_extender_page, user-controlled input from the key parameter is incorporated into a shell command without proper validation or neutralization. The code reads QUERY_STRING, extracts parameters via web_get, retrieves lan_ipaddr from NVRAM, concatenates lan_ipaddr with the attacker-controlled key value, formats a command of the form echo -n '%s' | md5sum using sprintf, and executes it via popen. Because shell metacharacters in key are not sanitized, an attacker can break out of the intended command context and inject arbitrary shell commands. The injected commands execute in the security context of root.

CVE-2021-35400First seen Apr 11, 2026

CVE-2021-35401 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, tested on firmware version 20190909. The flaw is in /cgi-bin/login.cgi, specifically the sys_login code path reached when the POST parameter page=login and langChange is not equal to "1". In that path, the application reads the attacker-controlled key parameter from the HTTP request body, concatenates it with the stored Password value from NVRAM, formats a shell command using sprintf with the pattern "echo -n '%s' | md5sum", and executes it via popen. Because the key parameter is not properly validated or sanitized before being embedded in a shell command, an attacker can inject shell metacharacters and execute arbitrary commands. The vulnerable process runs with root privileges on the router.

CVE-2021-35401First seen Apr 11, 2026