Advisories · Technology
nezha.
Every CVE that names nezha among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.0 Medium
Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History
- nezha
- Memory corruption
- CVSS 7.1 High
Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint
- nezha
- CWE-212
- CVSS 5.3 Medium
Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig
- nezha
- CWE-204
- CVSS 6.3 Medium
Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
- nezha
- Open redirect
- CVSS 7.1 High
Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket
- nezha
- Denial of service
- CVSS 7.1 High
Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket
- nezha
- Denial of service
- CVSS 7.1 High
Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock
- nezha
- CWE-667
- CVSS 6.0 Medium
Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints
- nezha
- Race condition
- CVSS 2.3 Low
Nezha before 2.2.7 Information Disclosure via /api/v1/profile
- nezha
- Hard-coded credentials
- CVSS 6.0 Medium
Nezha before 2.3.1 Denial of Service via Concurrent Server Delete
- nezha
- Race condition
- CVSS 5.3 Medium
Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6
- nezha
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Nezha Dashboard before 2.3.5 Task Type Validation Bypass
- nezha
- Privilege escalation
- CVSS 7.1 High
Nezha before 2.3.8 Denial of Service via Alert Rule
- nezha
- CWE-197