https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-24414.htmlhttps://patchthecve.com/cve/CVE-2026-24414.htmlWed, 17 Jun 2026 10:23:02 +0000MEDIUM 5.5: The Icinga PowerShell Framework provides configuration and check possibilities to ensure integration and monitoring of Windows environments. In versions prior to 1.13.4, 1.12.4, and 1.11.2, permissions of the Icinga for Windows `certificate` directory grant every user read access, which results in thttps://patchthecve.com/cve/CVE-2026-24413.htmlhttps://patchthecve.com/cve/CVE-2026-24413.htmlWed, 17 Jun 2026 10:23:01 +0000MEDIUM 5.5: Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\icinga2\var` folder on Windows. This resulted in the its contents - including the private key of the https://patchthecve.com/cve/CVE-2025-61909.htmlhttps://patchthecve.com/cve/CVE-2025-61909.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 4.4: Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user,https://patchthecve.com/cve/CVE-2025-61908.htmlhttps://patchthecve.com/cve/CVE-2025-61908.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 6.5: Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. This can be used by any API user with access to an API endpoint that allows specifying a fihttps://patchthecve.com/cve/CVE-2025-61907.htmlhttps://patchthecve.com/cve/CVE-2025-61907.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 6.5: Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that shttps://patchthecve.com/cve/CVE-2025-61789.htmlhttps://patchthecve.com/cve/CVE-2025-61789.htmlFri, 09 Oct 2026 10:10:00 +0000MEDIUM 5.3: Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assignedhttps://patchthecve.com/cve/CVE-2025-53840.htmlhttps://patchthecve.com/cve/CVE-2025-53840.htmlWed, 17 Jun 2026 09:39:00 +0000LOW 2.4: Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependency Views, are allowed to see hosts and services that they weren't meant to on the dependency map. However, the name of an object will not be rhttps://patchthecve.com/cve/CVE-2025-48057.htmlhttps://patchthecve.com/cve/CVE-2025-48057.htmlWed, 17 Jun 2026 09:29:04 +0000CRITICAL 9.8: Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as validhttps://patchthecve.com/cve/CVE-2025-30164.htmlhttps://patchthecve.com/cve/CVE-2025-30164.htmlWed, 17 Jun 2026 09:08:16 +0000MEDIUM 4.1: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulahttps://patchthecve.com/cve/CVE-2025-27609.htmlhttps://patchthecve.com/cve/CVE-2025-27609.htmlWed, 17 Jun 2026 09:03:54 +0000MEDIUM 5.4: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbitrary Javascript into it and to act on behhttps://patchthecve.com/cve/CVE-2025-27405.htmlhttps://patchthecve.com/cve/CVE-2025-27405.htmlWed, 17 Jun 2026 09:03:31 +0000HIGH 7.6: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that uhttps://patchthecve.com/cve/CVE-2025-27404.htmlhttps://patchthecve.com/cve/CVE-2025-27404.htmlWed, 17 Jun 2026 09:03:31 +0000HIGH 7.6: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of that uhttps://patchthecve.com/cve/CVE-2024-49369.htmlhttps://patchthecve.com/cve/CVE-2024-49369.htmlWed, 17 Jun 2026 07:59:46 +0000CRITICAL 9.8: Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster