目標達成 すべての支援者に感謝 — 100%達成しました!

目標: 1000 CNY · 調達済み: 1336 CNY

100%

nezha 产品漏洞列表 / CVE 中文分析 14

nezha 产品相关 14 条漏洞,AI 中文标题与摘要、CVSS、POC 一站汇总。

哪吒(Nezha)是一款开源主机监控与管理面板,本聚合页专门汇总该产品的各类安全漏洞信息,涵盖远程代码执行、权限提升及信息泄露等高风险缺陷。收录范围自产品发布以来的历史版本,持续追踪官方发布的安全补丁与公告。通过此页面,研究人员与运维人员可以快速了解哪吒面板在早期版本中暴露的架构弱点,检索特定版本的历史漏洞详情,从而及时评估现有部署环境的风险状况并进行必要的版本升级或配置加固。

ベンダー: nezhahq

CVE IDタイトルCVSS深刻度公開日
CVE-2026-59155 Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API CWE-200--2026-07-10
CVE-2026-53523 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection CWE-601 6.8 Medium2026-06-12
CVE-2026-53522 Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS CWE-770 6.5 Medium2026-06-12
CVE-2026-53521 Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context CWE-863 6.4 Medium2026-06-12
CVE-2026-53520 Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing CWE-284 6.5 Medium2026-06-12
CVE-2026-53519 Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key CWE-22 9.1 Critical2026-06-12
CVE-2026-49397 Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data CWE-200 5.3 Medium2026-06-12
CVE-2026-49396 Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents CWE-352 7.1 High2026-06-12
CVE-2026-48119 Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services CWE-862 7.1 High2026-06-12
CVE-2026-47124 Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members CWE-200 6.5 Medium2026-06-12
CVE-2026-47120 Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) CWE-862 7.1 High2026-06-12
CVE-2026-46717 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification CWE-863 7.7 High2026-06-12
CVE-2026-46716 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron CWE-78 9.9 Critical2026-06-12
CVE-2026-47268 Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host CWE-918 6.4 Medium2026-06-12

nezha 产品累计公开 14 条 CVE 漏洞,本页提供按时间倒序的完整列表,包含 CVSS、CWE、AI 中文摘要与可获取的 POC 链接。