CA
Vendor
Cacti
159
CVEs
1
On KEV
3
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-49442 New | CA cacti Cacti | 5.3 | Oct 23 | Cacti: User Enumeration via Error Messages |
| CVE-2026-39902 New | CA cacti Cacti | 7.2 | Oct 23 | Cacti: Authenticated RCE on Data Input |
| CVE-2026-46531 New | CA cacti Cacti | 5.5 | Oct 23 | Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368) |
| CVE-2026-71287 | CA cacti Cacti | 8.8 | Aug 5 | Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection |
| CVE-2026-40941 | CA cacti Cacti | 6.5 | Jun 25 | Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages |
| CVE-2026-40084 | CA cacti Cacti | 6.5 | Jun 25 | Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter |
| CVE-2026-40083 | CA cacti Cacti | 7.2 | Jun 25 | Cacti: SQL Injection in managers.php |
| CVE-2026-40082 | CA cacti Cacti | 5.4 | Jun 25 | Cacti: Session Fixation via missing session_regenerate_id() after login |
| CVE-2026-40080 | CA cacti Cacti | 6.1 | Jun 25 | Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect |
| CVE-2026-40079 | CA cacti Cacti | 9.8 | Jun 24 | Cacti: Command Injection via escape_command() no-op in RRDtool execution |
| CVE-2026-39951 | CA cacti Cacti | 8.8 | Jun 24 | Cacti: Stored SQL Injection via graph_name_regexp in Reports feature |
| CVE-2026-39948 | CA cacti Cacti | 9.8 | Jun 24 | Cacti has SQL Injection via rfilter parameter in RLIKE clauses |
| CVE-2026-39955 | CA cacti Cacti | 9.8 | Jun 24 | Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php |
| CVE-2026-39938 | CA cacti Cacti | 9.8 | Jun 24 | Cacti: Unauthenticated RCE on Graph Image |
| CVE-2026-39900 | CA cacti Cacti | 6.1 | Jun 24 | Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript context |
| CVE-2026-39899 | CA cacti Cacti | 5.3 | Jun 24 | Cacti: Path Traversal via filename parameter in package_import.php |
| CVE-2026-39897 | CA cacti Cacti | 6.1 | Jun 24 | Cacti has a Reflected XSS Vulnerability via html_auth_footer |
| CVE-2026-39894 | CA cacti Cacti | 2.5 | Jun 24 | Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting |
| CVE-2026-39893 | CA cacti Cacti | 9.8 | Jun 24 | Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php |
| CVE-2025-66399 | CA cacti Cacti | 8.8 | Dec 2 | SNMP Command Injection leads to RCE in Cacti |
| CVE-2005-10004 | CA Cacti Cacti | 8.8 | Aug 30 | Cacti graph_view.php RCE via graph_start Parameter Injection |
| CVE-2025-26520 | CA Cacti Cacti | 9.8 | Feb 12 | Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter |
| CVE-2025-24368 | CA cacti Cacti | 7.5 | Jan 27 | Cacti has a SQL Injection vulnerability when using tree rules through Automation API |
| CVE-2025-24367 | CA cacti Cacti | 8.8 | Jan 27 | Cacti allows Arbitrary File Creation leading to RCE |
| CVE-2025-22604 | CA cacti Cacti | 7.2 | Jan 27 | Cacti has Authenticated RCE via multi-line SNMP responses |
| CVE-2024-54145 | CA cacti Cacti | 8.8 | Jan 27 | Cacti has a SQL Injection vulnerability when request automation devices |
| CVE-2024-54146 | CA cacti Cacti | 8.8 | Jan 27 | Cacti has a SQL Injection vulnerability when view host template |
| CVE-2024-45598 | CA cacti Cacti | 4.9 | Jan 27 | Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path |
| CVE-2024-43363 | CA cacti Cacti | 7.2 | Oct 7 | Remote code execution via Log Poisoning in Cacti |
| CVE-2024-43365 | CA cacti Cacti | 8.2 | Oct 7 | Stored Cross-site Scripting (XSS) when creating external links in Cacti |
| CVE-2024-43364 | CA cacti Cacti | 8.2 | Oct 7 | Stored Cross-site Scripting (XSS) when creating external links in Cacti |
| CVE-2024-43362 | CA cacti Cacti | 5.4 | Oct 7 | Stored Cross-site Scripting (XSS) when creating external links in Cacti |
| CVE-2024-34340 | CA cacti Cacti | 9.1 | May 13 | Authentication Bypass when using using older password hashes |
| CVE-2024-31460 | CA cacti Cacti | 8.8 | May 13 | Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database |
| CVE-2024-31459 | CA cacti Cacti | 7.2 | May 13 | Cacti RCE vulnerability by file include in lib/plugin.php |
| CVE-2024-31458 | CA cacti Cacti | 8.0 | May 13 | Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database |
| CVE-2024-31445 | CA cacti Cacti | 8.8 | May 13 | SQL Injection vulnerability in automation_get_new_graphs_sql |
| CVE-2024-31444 | CA cacti Cacti | 5.4 | May 13 | Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database |
| CVE-2024-31443 | CA cacti Cacti | 5.4 | May 13 | Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database |
| CVE-2024-30268 | CA cacti Cacti | 6.1 | May 13 | Cacti XSS vulnerability in display_settings |
| CVE-2024-29895 | CA cacti Cacti | 10.0 | May 13 | Cacti command injection in cmd_realtime.php |
| CVE-2024-29894 | CA cacti Cacti | 4.7 | May 13 | Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API |
| CVE-2024-27082 | CA cacti Cacti | 5.4 | May 13 | Cacti Cross-site Scripting vulnerability when managing trees |
| CVE-2024-25641 | CA cacti Cacti | 7.2 | May 13 | Cacti RCE vulnerability when importing packages |
| CVE-2023-51448 | CA cacti Cacti | 8.8 | Dec 22 | SQL Injection vulnerability when managing SNMP Notification Receivers |
| CVE-2023-50250 | CA cacti Cacti | 6.1 | Dec 22 | Cross-Site Scripting vulnerability when Import xml template file |
| CVE-2023-49088 | CA cacti Cacti | 4.8 | Dec 22 | Cacti has incomplete fix for CVE-2023-39515 |
| CVE-2023-49085 | CA cacti Cacti | 8.8 | Dec 22 | Cacti SQL Injection vulnerability |
| CVE-2023-49086 | CA cacti Cacti | 5.4 | Dec 21 | Cacti is vulnerable to cross-Site scripting (XSS) DOM |
| CVE-2023-49084 | CA cacti Cacti | 8.8 | Dec 21 | Local File Inclusion (RCE) in Cacti |
| CVE-2023-46490 | CA Cacti Cacti | 6.5 | Oct 27 | SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via the form_actions() function in the managers.php function |
| CVE-2023-39511 | CA Cacti Cacti | 4.8 | Sep 6 | Cacti is an open source operational monitoring and fault management framework |
| CVE-2023-39516 | CA Cacti Cacti | 4.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework |
| CVE-2023-39365 | CA Cacti Cacti | 6.3 | Sep 5 | Cacti is an open source operational monitoring and fault management framework |
| CVE-2023-39364 | CA Cacti Cacti | 5.4 | Sep 5 | Cacti is an open source operational monitoring and fault management framework |
| CVE-2023-39362 | CA Cacti Cacti | 7.2 | Sep 5 | Cacti is an open source operational monitoring and fault management framework |
| CVE-2023-39358 | CA Cacti Cacti | 8.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework |
| CVE-2023-39357 | CA Cacti Cacti | 8.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework |
| CVE-2023-31132 | CA Cacti Cacti | 7.8 | Sep 5 | Cacti is an open source operational monitoring and fault management framework |
| CVE-2023-30534 | CA Cacti Cacti | 4.3 | Sep 5 | Cacti is an open source operational monitoring and fault management framework |