LS
Product
Log Server
23
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 13Low 0
Watch
Add Log Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-34277 | 9.8 | Oct 30 | Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID Affected: before 2024R1.3.1 |
| CVE-2025-34274 | 9.8 | Oct 30 | Nagios Log Server < 2024R2.0.3 Logstash Process Root Privileges Affected: before 2024R2.0.3 |
| CVE-2025-34271 | 9.8 | Oct 30 | Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext Affected: before 2024R2.0.2 |
| CVE-2025-34298 | 8.8 | Oct 30 | Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation Affected: before 2024R1.3.2 |
| CVE-2025-44823 | 8.8 | Oct 7 | Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call Affected: before 2024R1.3.2 |
| CVE-2025-29471 | 8.3 | Apr 15 | Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field Affected: 2024 |
| CVE-2023-7322 | 8.1 | Oct 30 | Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API Access Affected: before 2024R1 |
| CVE-2025-34323 | 7.8 | Nov 17 | Nagios Log Server < 2026R1.0.1 Local Privilege Escalation via Writable Scripts and Sudo Rules Affected: before 2026R1.0.1 |
| CVE-2024-58273 | 7.8 | Oct 30 | Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to Root Affected: before 2024R1.0.2 |
| CVE-2025-34322 | 7.2 | Nov 17 | Nagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language Queries Affected: before 2026R1.0.1 |
| CVE-2025-34272 | 6.5 | Oct 30 | Nagios Log Server < 2024R2.0.3 Non-Empty Default Dashboard Fallback Affected: before 2024R2.0.3 |
| CVE-2025-34273 | 6.5 | Oct 30 | Nagios Log Server < 2024R2.0.3 Non-Admin Dashboard Deletion Affected: before 2024R2.0.3 |
| CVE-2025-44824 | 6.5 | Oct 7 | Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a… Affected: before 2024R1.3.2 |
| CVE-2020-25385 | 6.1 | Jan 20 | Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact… Affected: through 2.1.7 |
| CVE-2019-15898 | 6.1 | Sep 3 | Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page Affected: before 2.0.8 |
| CVE-2023-7321 | 5.4 | Oct 30 | Nagios Log Server < 2.1.14 XSS via Snapshots Page Affected: before 2.1.14 |
| CVE-2023-7323 | 5.4 | Oct 30 | Nagios Log Server < 2024R1 XSS via Create User Function Affected: before 2024R1 |
| CVE-2020-36858 | 5.4 | Oct 30 | Nagios Log Server < 2.1.6 XSS via Create User, Edit User, & Manage Host Lists Pages Affected: before 2.1.6 |
| CVE-2016-15049 | 5.4 | Oct 30 | Nagios Log Server < 1.4.2 Dashboards Logs Table XSS Affected: before 1.4.2 |
| CVE-2021-35479 | 5.4 | Jul 30 | Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter Affected: before 2.1.9 |
| CVE-2021-35478 | 5.4 | Jul 30 | Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function Affected: before 2.1.9 |
| CVE-2020-16157 | 5.4 | Jul 30 | A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu Affected: before 2.1.7 |
| CVE-2025-34270 | 4.9 | Oct 30 | Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated Affected: before 2024R2.0.2 |
Showing 23