Advisories · Technology
netdata.
Every CVE that names netdata among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.0 High
Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution
- netdata
- Privilege escalation
- CVSS 6.5 Medium
Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent
- netdata
- Denial of service
- CWE-193
- CVSS 7.8 High
Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair
- netdata
- Privilege escalation
- CWE-427
- CVSS 8.4 High
Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
- netdata
- Path traversal
- Insecure deserialization
- CVSS 6.5 Medium
Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write
- netdata
- Memory corruption
- CVSS 6.5 Medium
Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK
- netdata
- Broken access control
- CVSS 7.5 High
Netdata: WebSocket Decompression Bomb
- netdata
- CWE-409
- CVSS 5.1 Medium
Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint
- netdata
- Cross-site scripting (XSS)
- CVSS 8.8 High
ndsudo: local privilege escalation via untrusted search path
- netdata
- CWE-426
- CVSS 6.5 Medium
Netdata is vulnerable to improper authentication
- netdata
- Authentication bypass
- CVSS 8.1 HighCritical · CVSS 7+ and EPSS
Netdata vulnerable to command injection
- netdata
- Command injection
- CWE-20