{"id":"EUVD-2026-36596","enisaUuid":"0165eaf2-76eb-3fe8-b823-0d9efeb21063","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim\u0027s agents. This issue has been patched in version 2.0.14.","datePublished":"Jun 12, 2026, 9:03:28 PM","dateUpdated":"Jun 13, 2026, 3:41:11 AM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg\n","aliases":"CVE-2026-49396\nGHSA-8qhj-4f8c-j8qg\n","assigner":"GitHub_M","epss":0.14,"enisaIdProduct":[{"id":"8dfc7e03-a620-30a0-a234-c35b67706170","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"1.0.0, \u003c 2.0.14"}],"enisaIdVendor":[{"id":"8f53e409-a96b-3d7f-a952-0fe5094db4fa","vendor":{"name":"nezhahq"}}],"enisaIdVulnerability":[{"id":"5b9e76f3-147f-3bc7-a85b-b019d7d79125","vulnerability":{"id":"GHSA-8qhj-4f8c-j8qg","description":"Nezha has cross-site GET request that can trigger stored cron commands on a victim\u0027s agents","datePublished":"Jun 10, 2026, 1:39:21 PM","dateUpdated":"Jun 26, 2026, 9:28:58 PM","baseScore":0.0,"references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49396\nhttps://github.com/nezhahq/nezha\n","enisa_id":"EUVD-2026-36596\n","aliases":"CVE-2026-49396\nGHSA-8qhj-4f8c-j8qg\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d7759dd7-9015-355e-86c7-0685a9477de3","vulnerability":{"id":"CVE-2026-49396","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim\u0027s agents. This issue has been patched in version 2.0.14.","datePublished":"Jun 12, 2026, 9:03:28 PM","dateUpdated":"Jun 13, 2026, 3:41:11 AM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg\n","enisa_id":"EUVD-2026-36596\n","assigner":"GitHub_M","epss":0.14,"dataProcessed":"Nov 7, 2026, 7:22:41 AM","vulnerabilityProduct":[{"id":"a98d7506-81f8-3bb2-b45c-e5bb9cd092ef","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"1.0.0, \u003c 2.0.14"}],"vulnerabilityVendor":[{"id":"48f6e309-4125-3da5-a7fb-01a29cd54b82","vendor":{"name":"nezhahq"}}]}}],"enisaIdAdvisory":[]}