{"schema_version":1,"title":"Nezha vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in Nezha: 0 in the last 7 days and 9 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120046, was published on 30 October 2026. 4 vulnerabilities in the last four weeks, down 20% on the four before (5). 0 critical against 1.","url":"https://junglewise.ai/threats/technologies/nezha-nezha","json_url":"https://junglewise.ai/threats/technologies/nezha-nezha.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/nezha-nezha","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":9,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":4,"last_90_days":9,"last_365_days":9},"latest":[{"cve":"CVE-2026-120046","cvss":5.3,"slug":"cve-2026-120046-nezha-2-0-0-before-2-4-0-contains-a-null-pointer-dereference","title":"Nezha dashboard NULL pointer dereference in loadTodayStats","severity":"medium","exploited":false,"published_at":"2026-10-30T19:18:22.93+00:00","url":"https://junglewise.ai/threats/cve-2026-120046-nezha-2-0-0-before-2-4-0-contains-a-null-pointer-dereference"},{"cve":"CVE-2026-111386","cvss":4.3,"epss":0.0021,"slug":"cve-2026-111386-nezha-from-1-7-0-before-2-3-15-contains-an-information","title":"Nezha information disclosure in server configuration APIs","severity":"medium","exploited":false,"published_at":"2026-10-16T03:18:06.057+00:00","url":"https://junglewise.ai/threats/cve-2026-111386-nezha-from-1-7-0-before-2-3-15-contains-an-information"},{"cve":"CVE-2026-111385","cvss":4.8,"epss":0.0019,"slug":"cve-2026-111385-nezha-from-2-1-0-before-2-3-15-contains-a-host-header-injection","title":"Nezha host header injection in file transfer URLs","severity":"medium","exploited":false,"published_at":"2026-10-16T03:18:05.893+00:00","url":"https://junglewise.ai/threats/cve-2026-111385-nezha-from-2-1-0-before-2-3-15-contains-a-host-header-injection"},{"cve":"CVE-2026-111383","cvss":6.5,"epss":0.003,"slug":"cve-2026-111383-nezha-from-2-0-13-before-2-3-15-contains-a-resource-exhaustion","title":"Nezha resource exhaustion in WebSocket endpoint","severity":"medium","exploited":false,"published_at":"2026-10-16T03:18:05.537+00:00","url":"https://junglewise.ai/threats/cve-2026-111383-nezha-from-2-0-13-before-2-3-15-contains-a-resource-exhaustion"},{"cve":"CVE-2026-105112","cvss":5.3,"epss":0.0018,"slug":"cve-2026-105112-nezha-from-1-8-0-before-2-3-13-contains-a-lock-order-inversion","title":"Nezha lock-order inversion in notification groups","severity":"medium","exploited":false,"published_at":"2026-10-03T14:16:37.677+00:00","url":"https://junglewise.ai/threats/cve-2026-105112-nezha-from-1-8-0-before-2-3-13-contains-a-lock-order-inversion"},{"cve":"CVE-2026-101090","cvss":9.8,"epss":0.0036,"slug":"cve-2026-101090-nezha-2-2-3-contains-a-host-header-injection-regression-in-the","title":"Nezha Host header injection in OAuth2 redirect endpoint","severity":"critical","exploited":false,"published_at":"2026-09-27T21:17:03.003+00:00","url":"https://junglewise.ai/threats/cve-2026-101090-nezha-2-2-3-contains-a-host-header-injection-regression-in-the"},{"cve":"CVE-2026-101088","cvss":5.3,"slug":"cve-2026-101088-nezha-is-a-server-and-website-monitoring-tool-in-versions-2-2-11","title":"Nezha race condition in service sentinel worker","severity":"medium","exploited":false,"published_at":"2026-09-27T21:17:02.727+00:00","url":"https://junglewise.ai/threats/cve-2026-101088-nezha-is-a-server-and-website-monitoring-tool-in-versions-2-2-11"},{"cve":"CVE-2026-101087","cvss":4.3,"slug":"cve-2026-101087-nezha-versions-2-0-10-through-2-3-2-use-a-restricted-http-client","title":"Nezha incomplete SSRF denylist for IPv6 transition ranges","severity":"medium","exploited":false,"published_at":"2026-09-27T21:17:02.587+00:00","url":"https://junglewise.ai/threats/cve-2026-101087-nezha-versions-2-0-10-through-2-3-2-use-a-restricted-http-client"},{"cve":"CVE-2026-101085","cvss":6.5,"slug":"cve-2026-101085-nezha-before-2-3-8-fails-to-validate-alert-rule-type-and","title":"Nezha input validation bypass in alert rule creation","severity":"medium","exploited":false,"published_at":"2026-09-27T21:17:02.307+00:00","url":"https://junglewise.ai/threats/cve-2026-101085-nezha-before-2-3-8-fails-to-validate-alert-rule-type-and"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":1,"exploited":0,"vulnerabilities":4},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Nezha","slug":"nezha-nezha","vendor":{"hub":true,"name":"Nezha","slug":"nezha","url":"https://junglewise.ai/threats/vendors/nezha"},"aliases":[],"category":"service","url":"https://junglewise.ai/threats/technologies/nezha-nezha"},"most_severe":[{"cve":"CVE-2026-101090","cvss":9.8,"epss":0.0036,"slug":"cve-2026-101090-nezha-2-2-3-contains-a-host-header-injection-regression-in-the","title":"Nezha Host header injection in OAuth2 redirect endpoint","severity":"critical","exploited":false,"published_at":"2026-09-27T21:17:03.003+00:00","url":"https://junglewise.ai/threats/cve-2026-101090-nezha-2-2-3-contains-a-host-header-injection-regression-in-the"},{"cve":"CVE-2026-111383","cvss":6.5,"epss":0.003,"slug":"cve-2026-111383-nezha-from-2-0-13-before-2-3-15-contains-a-resource-exhaustion","title":"Nezha resource exhaustion in WebSocket endpoint","severity":"medium","exploited":false,"published_at":"2026-10-16T03:18:05.537+00:00","url":"https://junglewise.ai/threats/cve-2026-111383-nezha-from-2-0-13-before-2-3-15-contains-a-resource-exhaustion"},{"cve":"CVE-2026-101085","cvss":6.5,"slug":"cve-2026-101085-nezha-before-2-3-8-fails-to-validate-alert-rule-type-and","title":"Nezha input validation bypass in alert rule creation","severity":"medium","exploited":false,"published_at":"2026-09-27T21:17:02.307+00:00","url":"https://junglewise.ai/threats/cve-2026-101085-nezha-before-2-3-8-fails-to-validate-alert-rule-type-and"},{"cve":"CVE-2026-105112","cvss":5.3,"epss":0.0018,"slug":"cve-2026-105112-nezha-from-1-8-0-before-2-3-13-contains-a-lock-order-inversion","title":"Nezha lock-order inversion in notification groups","severity":"medium","exploited":false,"published_at":"2026-10-03T14:16:37.677+00:00","url":"https://junglewise.ai/threats/cve-2026-105112-nezha-from-1-8-0-before-2-3-13-contains-a-lock-order-inversion"},{"cve":"CVE-2026-120046","cvss":5.3,"slug":"cve-2026-120046-nezha-2-0-0-before-2-4-0-contains-a-null-pointer-dereference","title":"Nezha dashboard NULL pointer dereference in loadTodayStats","severity":"medium","exploited":false,"published_at":"2026-10-30T19:18:22.93+00:00","url":"https://junglewise.ai/threats/cve-2026-120046-nezha-2-0-0-before-2-4-0-contains-a-null-pointer-dereference"},{"cve":"CVE-2026-101088","cvss":5.3,"slug":"cve-2026-101088-nezha-is-a-server-and-website-monitoring-tool-in-versions-2-2-11","title":"Nezha race condition in service sentinel worker","severity":"medium","exploited":false,"published_at":"2026-09-27T21:17:02.727+00:00","url":"https://junglewise.ai/threats/cve-2026-101088-nezha-is-a-server-and-website-monitoring-tool-in-versions-2-2-11"},{"cve":"CVE-2026-111385","cvss":4.8,"epss":0.0019,"slug":"cve-2026-111385-nezha-from-2-1-0-before-2-3-15-contains-a-host-header-injection","title":"Nezha host header injection in file transfer URLs","severity":"medium","exploited":false,"published_at":"2026-10-16T03:18:05.893+00:00","url":"https://junglewise.ai/threats/cve-2026-111385-nezha-from-2-1-0-before-2-3-15-contains-a-host-header-injection"},{"cve":"CVE-2026-111386","cvss":4.3,"epss":0.0021,"slug":"cve-2026-111386-nezha-from-1-7-0-before-2-3-15-contains-an-information","title":"Nezha information disclosure in server configuration APIs","severity":"medium","exploited":false,"published_at":"2026-10-16T03:18:06.057+00:00","url":"https://junglewise.ai/threats/cve-2026-111386-nezha-from-1-7-0-before-2-3-15-contains-an-information"},{"cve":"CVE-2026-101087","cvss":4.3,"slug":"cve-2026-101087-nezha-versions-2-0-10-through-2-3-2-use-a-restricted-http-client","title":"Nezha incomplete SSRF denylist for IPv6 transition ranges","severity":"medium","exploited":false,"published_at":"2026-09-27T21:17:02.587+00:00","url":"https://junglewise.ai/threats/cve-2026-101087-nezha-versions-2-0-10-through-2-3-2-use-a-restricted-http-client"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}