CVE-2026-49396

Published June 12th, 2026

View on NVD ↗

CVSS v3

7.1

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14.

nezhahq/nezha

:trollface: Self-hosted, lightweight server and website monitoring and O&M tool

GitHub

10.2K