# nezha.

Every CVE that names nezha among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History](https://agentprime.io/advisories/CVE-2026-120046.md)
  `CVE-2026-120046` · CVE record: nezhahq nezha · CVSS 6.0 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption
- [Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint](https://agentprime.io/advisories/CVE-2026-111387.md)
  `CVE-2026-111387` · CVE record: nezhahq nezha · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-212
- [Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig](https://agentprime.io/advisories/CVE-2026-111386.md)
  `CVE-2026-111386` · CVE record: nezhahq nezha · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-204
- [Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools](https://agentprime.io/advisories/CVE-2026-111385.md)
  `CVE-2026-111385` · CVE record: nezhahq nezha · CVSS 6.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Open redirect
- [Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket](https://agentprime.io/advisories/CVE-2026-111384.md)
  `CVE-2026-111384` · CVE record: nezhahq nezha · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket](https://agentprime.io/advisories/CVE-2026-111383.md)
  `CVE-2026-111383` · CVE record: nezhahq nezha · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service
- [Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock](https://agentprime.io/advisories/CVE-2026-105113.md)
  `CVE-2026-105113` · CVE record: nezhahq nezha · CVSS 7.1 High · Not analysed yet · Published 3 Oct 2026 · Tags: CWE-667
- [Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints](https://agentprime.io/advisories/CVE-2026-105112.md)
  `CVE-2026-105112` · CVE record: nezhahq nezha · CVSS 6.0 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Race condition
- [Nezha before 2.2.7 Information Disclosure via /api/v1/profile](https://agentprime.io/advisories/CVE-2026-101089.md)
  `CVE-2026-101089` · CVE record: nezhahq nezha · CVSS 2.3 Low · Not analysed yet · Published 27 Sept 2026 · Tags: Hard-coded credentials
- [Nezha before 2.3.1 Denial of Service via Concurrent Server Delete](https://agentprime.io/advisories/CVE-2026-101088.md)
  `CVE-2026-101088` · CVE record: nezhahq nezha · CVSS 6.0 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Race condition
- [Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6](https://agentprime.io/advisories/CVE-2026-101087.md)
  `CVE-2026-101087` · CVE record: nezhahq nezha · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Nezha Dashboard before 2.3.5 Task Type Validation Bypass](https://agentprime.io/advisories/CVE-2026-101086.md)
  `CVE-2026-101086` · CVE record: nezhahq nezha · CVSS 7.1 High · Not analysed yet · Published 27 Sept 2026 · Tags: Privilege escalation
- [Nezha before 2.3.8 Denial of Service via Alert Rule](https://agentprime.io/advisories/CVE-2026-101085.md)
  `CVE-2026-101085` · CVE record: nezhahq nezha · CVSS 7.1 High · Not analysed yet · Published 27 Sept 2026 · Tags: CWE-197

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=nezha>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/nezha/>. Everything for agents: <https://agentprime.io/llms.txt>.