CA
Product
cacti
On CISA KEVExploited in the wild
156
CVEs
1
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 11High 43Medium 63Low 1
Watch
Add cacti to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-46169 In wildKEV | 9.8 | Dec 5 | Unauthenticated Command Injection Affected: < 1.2.23 |
| CVE-2026-40079 | 9.8 | Jun 24 | Cacti: Command Injection via escape_command() no-op in RRDtool execution Affected: < 1.2.31 |
| CVE-2026-39948 | 9.8 | Jun 24 | Cacti has SQL Injection via rfilter parameter in RLIKE clauses Affected: < 1.2.31 |
| CVE-2026-39955 | 9.8 | Jun 24 | Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php Affected: < 1.2.31 |
| CVE-2026-39938 | 9.8 | Jun 24 | Cacti: Unauthenticated RCE on Graph Image Affected: < 1.2.31 |
| CVE-2026-39893 | 9.8 | Jun 24 | Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php Affected: < 1.2.31 |
| CVE-2025-26520 | 9.8 | Feb 12 | Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter Affected: before 1.2.29 |
| CVE-2023-39361 | 9.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: 1.2.24 |
| CVE-2022-0730 | 9.8 | Mar 3 | Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types Affected: 1.2.19 |
| CVE-2017-12065 | 9.8 | Aug 1 | spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter Affected: through 1.1.15 |
| CVE-2024-34340 | 9.1 | May 14 | Cacti provides an operational monitoring and fault management framework Affected: before 1.2.27 |
| CVE-2026-71287 | 8.8 | Aug 5 | Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection Affected: through 1.3.0-dev |
| CVE-2026-39951 | 8.8 | Jun 24 | Cacti: Stored SQL Injection via graph_name_regexp in Reports feature Affected: < 1.2.31 |
| CVE-2025-66399 | 8.8 | Dec 2 | Cacti is an open source performance and fault management framework Affected: before 1.2.29 |
| CVE-2005-10004 | 8.8 | Aug 30 | Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script Affected: before 0.8.6d |
| CVE-2025-24367 | 8.8 | Jan 27 | Cacti is an open source performance and fault management framework Affected: before 1.2.29 |
| CVE-2024-54146 | 8.8 | Jan 27 | Cacti is an open source performance and fault management framework Affected: before 1.2.29 |
| CVE-2024-54145 | 8.8 | Jan 27 | Cacti is an open source performance and fault management framework Affected: before 1.2.29 |
| CVE-2024-31460 | 8.8 | May 14 | Cacti provides an operational monitoring and fault management framework Affected: before 1.2.27 |
| CVE-2024-31445 | 8.8 | May 14 | Cacti provides an operational monitoring and fault management framework Affected: before 1.2.27 |
| CVE-2023-51448 | 8.8 | Dec 22 | Cacti provides an operational monitoring and fault management framework Affected: 1.2.25 |
| CVE-2023-49085 | 8.8 | Dec 22 | Cacti provides an operational monitoring and fault management framework Affected: through 1.2.25 |
| CVE-2023-49084 | 8.8 | Dec 21 | Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB) Affected: 1.2.25 |
| CVE-2023-39358 | 8.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2023-39357 | 8.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: 1.2.24 |
| CVE-2023-39359 | 8.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2020-35701 | 8.8 | Jan 11 | An issue was discovered in Cacti 1.2.x through 1.2.16 Affected: 1.2.0 through 1.2.16 |
| CVE-2020-8813 | 8.8 | Feb 22 | graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege Affected: 1.2.8 |
| CVE-2020-7237 | 8.8 | Jan 20 | Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php Affected: 1.2.8 |
| CVE-2020-7058 | 8.8 | Jan 15 | data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input Methods -> Unix -> Ping Host Affected: 1.2.8 |
| CVE-2016-10700 | 8.8 | Nov 24 | auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti… Affected: before 1.0.0 |
| CVE-2014-4000 | 8.8 | Nov 15 | Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling… Affected: before 1.0.0 |
| CVE-2017-1000031 | 8.8 | Jul 17 | SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and… Affected: 0.8.8b |
| CVE-2016-2313 | 8.8 | Apr 13 | auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti… Affected: through 0.8.8f |
| CVE-2016-3172 | 8.8 | Apr 12 | SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit… Affected: through 0.8.8g |
| CVE-2015-8604 | 8.8 | Apr 11 | SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via… Affected: through 0.8.8f |
| CVE-2016-3659 | 8.8 | Apr 11 | SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter Affected: through 0.8.8g |
| CVE-2024-43365 | 8.2 | Oct 7 | Cacti is an open source performance and fault management framework Affected: 1.2.27 |
| CVE-2024-43364 | 8.2 | Oct 7 | Cacti is an open source performance and fault management framework Affected: before 1.2.28 |
| CVE-2019-17358 | 8.1 | Dec 12 | Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays Affected: through 1.2.7 |
| CVE-2024-31458 | 8.0 | May 14 | Cacti provides an operational monitoring and fault management framework Affected: before 1.2.27 |
| CVE-2023-31132 | 7.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework Affected: before 1.2.25 |
| CVE-2025-24368 | 7.5 | Jan 27 | Cacti is an open source performance and fault management framework Affected: before 1.2.29 |
| CVE-2023-37543 | 7.5 | Aug 10 | Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php Affected: before 1.2.6 |
| CVE-2026-39902 New | 7.2 | Oct 23 | Cacti: Authenticated RCE on Data Input Affected: < 1.2.31 |
| CVE-2026-40083 | 7.2 | Jun 25 | Cacti: SQL Injection in managers.php Affected: < 1.2.31 |
| CVE-2025-22604 | 7.2 | Jan 27 | Cacti is an open source performance and fault management framework Affected: before 1.2.29 |
| CVE-2024-43363 | 7.2 | Oct 7 | Cacti is an open source performance and fault management framework Affected: before 1.2.28 |
| CVE-2024-31459 | 7.2 | May 14 | Cacti provides an operational monitoring and fault management framework Affected: before 1.2.27 |
| CVE-2024-25641 | 7.2 | May 14 | Cacti provides an operational monitoring and fault management framework Affected: before 1.2.27 |