Vulnerabilities in nezhahq
29 resultsCVE-2026-47268MEDIUMNezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard hostEPSS 0.3%CVE-2026-101085HIGHNezha before 2.3.8 Denial of Service via Alert RuleEPSS 0.2%CVE-2026-111386MEDIUMNezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfigEPSS 0.2%CVE-2026-105113HIGHNezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex DeadlockEPSS 0.2%CVE-2026-111385MEDIUMNezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer ToolsEPSS 0.2%CVE-2026-101088MEDIUMNezha before 2.3.1 Denial of Service via Concurrent Server DeleteEPSS 0.2%CVE-2026-105112MEDIUMNezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpointsEPSS 0.2%CVE-2026-49396HIGHNezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agentsEPSS 0.2%CVE-2026-101089LOWNezha before 2.2.7 Information Disclosure via /api/v1/profileEPSS 0.2%