{"id":"EUVD-2026-36597","enisaUuid":"a9329a08-bafb-3253-81c8-8d5ba38fd288","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 2.0.0 to before version 2.0.14, private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data. This issue has been patched in version 2.0.14.","datePublished":"Jun 12, 2026, 9:03:37 PM","dateUpdated":"Jun 15, 2026, 5:26:51 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-vrmh-5mmx-hjwx\n","aliases":"CVE-2026-49397\nGHSA-vrmh-5mmx-hjwx\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"4c8d6584-7857-3e88-a506-d5e0f588ea83","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"2.0.0, \u003c 2.0.14"}],"enisaIdVendor":[{"id":"d95a6101-307a-34df-9d7b-d80657082db5","vendor":{"name":"nezhahq"}}],"enisaIdVulnerability":[{"id":"5dd43437-d6bb-38fd-a00d-3e3802dbd791","vulnerability":{"id":"GHSA-vrmh-5mmx-hjwx","description":"Nezha\u0027s private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data","datePublished":"Jun 10, 2026, 1:39:24 PM","dateUpdated":"Jun 26, 2026, 9:29:08 PM","baseScore":0.0,"references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-vrmh-5mmx-hjwx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49397\nhttps://github.com/nezhahq/nezha\n","enisa_id":"EUVD-2026-36597\n","aliases":"CVE-2026-49397\nGHSA-vrmh-5mmx-hjwx\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"978d0402-15a0-3a18-be61-66cf9d4e4073","vulnerability":{"id":"CVE-2026-49397","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 2.0.0 to before version 2.0.14, private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data. This issue has been patched in version 2.0.14.","datePublished":"Jun 12, 2026, 9:03:37 PM","dateUpdated":"Jun 15, 2026, 5:26:51 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-vrmh-5mmx-hjwx\n","enisa_id":"EUVD-2026-36597\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Oct 30, 2026, 7:18:58 AM","vulnerabilityProduct":[{"id":"d464d28b-8839-305d-a726-355e43f1a81b","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"2.0.0, \u003c 2.0.14"}],"vulnerabilityVendor":[{"id":"9790997b-3d64-3085-9872-1441a4b290c7","vendor":{"name":"nezhahq"}}]}}],"enisaIdAdvisory":[]}