Known vulnerabilities in Icinga Web 2

Software: Icinga Web 2
Software CPE: cpe:2.3:a:www.icinga.org:icingaweb2:*:*:*:*:*:*:*:*
Total vulnerabilities: 15
Public exploits: 2
Known exploited (KEV): 1
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Icinga Web 2 Icinga Web 2 is affected by 15 known vulnerabilities: 4 medium, 11 low Critical High Medium Low

Vulnerabilities (15)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU136935 - URL Redirection to Untrusted Site ('Open Redirect')
CWE-601 Low
No
No
2.12.7, 2.13.1 06.07.2026 SB2026070656
#VU106054 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2025-30164
CWE-601 Medium
No
No
2.11.5, 2.12.3 26.03.2025 SB2025032627
#VU106053 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-27609
CWE-79 Low
No
No
2.11.5, 2.12.3 26.03.2025 SB2025032627
#VU106050 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-27404
CWE-79 Low
No
No
2.11.5, 2.12.3 26.03.2025 SB2025032627
#VU106041 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-27405
CWE-79 Low
No
No
2.11.5, 2.12.3 26.03.2025 SB2025032627
#VU70345 - Improper Access Control
CWE-284 Low
No
No
2.9.8, 2.10.4, 2.11.3 14.12.2022 SB2022121444
#VU70344 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.9.8, 2.10.4, 2.11.3 14.12.2022 SB2022121444
#VU70343 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.9.8, 2.10.4, 2.11.3 14.12.2022 SB2022121444
#VU70342 - URL Redirection to Untrusted Site ('Open Redirect')
CWE-601 Low
No
No
2.9.8, 2.10.4, 2.11.3 14.12.2022 SB2022121444
#VU136933 - Improper Access Control
CVE-2022-24714
CWE-284 Low
No
No
2.9.6 08.03.2022 SB2022030865
SB2022080446
#VU136932 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-24715
CWE-22 Medium
Available
No
2.9.6 08.03.2022 SB2022030865
SB2022080446
#VU136931 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-24716
CWE-22 Medium
Available
Exploited
2.9.6 08.03.2022 SB2022030865
SB2022080446
#VU136936 - Improper Access Control
CVE-2021-32747
CWE-284 Low
No
No
2.7.5, 2.8.3, 2.9.0 12.07.2021 SB2021071232
#VU136934 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-32746
CWE-22 Low
No
No
2.5.0, 2.6.0, 2.7.0, 2.8.0, 2.8.3 12.07.2021 SB2021071231
#VU45986 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2020-24368
CWE-22 Medium
No
No
2.6.4, 2.7.4, 2.8.2 24.08.2020 SB2020082411
SB2020082412
SB2020101608
and 2 more