Login Request a demo
CA
Product
cacti
by Cacti · last CVE Oct 23, 2026
On CISA KEVExploited in the wild
156
CVEs
1
On KEV
9.8
Max CVSS
3
New 30D
Vulnerabilities156In the news0Timeline
Severity mix
Critical 11High 43Medium 63Low 1
Severity
All severities156Critical11High43Medium63Low1
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add cacti to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-46169
In wildKEV
9.8
100%
Dec 5
Unauthenticated Command Injection
Affected: < 1.2.23
CVE-2026-40079
9.8
2%
Jun 24
Cacti: Command Injection via escape_command() no-op in RRDtool execution
Affected: < 1.2.31
CVE-2026-39948
9.8
1%
Jun 24
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
Affected: < 1.2.31
CVE-2026-39955
9.8
1%
Jun 24
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
Affected: < 1.2.31
CVE-2026-39938
9.8
1%
Jun 24
Cacti: Unauthenticated RCE on Graph Image
Affected: < 1.2.31
CVE-2026-39893
9.8
1%
Jun 24
Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php
Affected: < 1.2.31
CVE-2025-26520
9.8
0%
Feb 12
Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter
Affected: before 1.2.29
CVE-2023-39361
9.8
89%
Sep 5
Cacti is an open source operational monitoring and fault management framework
Affected: 1.2.24
CVE-2022-0730
9.8
3%
Mar 3
Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types
Affected: 1.2.19
CVE-2017-12065
9.8
3%
Aug 1
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter
Affected: through 1.1.15
CVE-2024-34340
9.1
1%
May 14
Cacti provides an operational monitoring and fault management framework
Affected: before 1.2.27
Showing 11