PatchTheCVEnagvis vulnerabilities and fixes
Recent CVEs affecting nagvis, with upgrade or downgrade steps. 4 tracked.
nagvis has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-12-03. Highest priority: CVE-2024-47093 (score 42/100).
- CVE-2025-39665 MEDIUM 5.3 UPGRADE User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to
- CVE-2024-47093 HIGH 8.8 UPGRADE Improper neutralization of input in Nagvis before version 1.9.42 which can lead to XSS
- CVE-2024-47090 MEDIUM 6.1 UPGRADE Improper neutralization of input in Nagvis before version 1.9.47 which can lead to XSS
- CVE-2024-38866 HIGH 7.5 UPGRADE Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection
FAQ
How do I fix nagvis vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nagvis being exploited right now?
None of the tracked nagvis CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nagvis CVE should I patch first?
CVE-2024-47093 currently ranks highest (42/100): Improper neutralization of input in Nagvis before version 1.9.42 which can lead to XSS.