PatchTheCVEmonica vulnerabilities and fixes
Recent CVEs affecting monica, with upgrade or downgrade steps. 7 tracked.
monica has 7 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2026-02-20. Highest priority: CVE-2026-26747 (score 51/100).
- CVE-2024-54999 MEDIUM 6.5 DOWNGRADE MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter th
- CVE-2024-54998 MEDIUM 5.4 DOWNGRADE MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason
- CVE-2024-54997 MEDIUM 5.4 DOWNGRADE MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry t
- CVE-2024-54996 HIGH 8.8 DOWNGRADE MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the
- CVE-2024-54994 MEDIUM 6.5 DOWNGRADE MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name an
- CVE-2026-26747 CRITICAL 9.1 DOWNGRADE A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header
- CVE-2024-54951 MEDIUM 5.4 DOWNGRADE Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS)
FAQ
How do I fix monica vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is monica being exploited right now?
None of the tracked monica CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which monica CVE should I patch first?
CVE-2026-26747 currently ranks highest (51/100): A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header .