Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification

Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents

Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services

Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)

Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API

Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint

Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant

Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock

Nezha Dashboard before 2.3.5 Task Type Validation Bypass

Nezha before 2.3.8 Denial of Service via Alert Rule

Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members

Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context

Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host

Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints

Nezha before 2.3.1 Denial of Service via Concurrent Server Delete

Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data

Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig

Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6

Nezha before 2.2.7 Information Disclosure via /api/v1/profile