Centreon
Vulnerability activity for Centreon: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 16
- Critical (CVSS 9+)
- 4
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.2HighOct 29, 2026Centreon SQL injectionCVE-2026-11587SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database
- 6.5MediumOct 29, 2026Centreon Auth bypass / access controlCVE-2025-12523Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user
- 5.4MediumOct 29, 2026Centreon Auth bypass / access controlCVE-2025-13050Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user
- 9.1CriticalFeb 27, 2026Centreon webCVE-2026-2750Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.
- 9.9CriticalFeb 27, 2026Centreon open tickets Path traversal / file handlingCVE-2026-2749Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10.3, 24.10.8, 24.04.7.
- 8.3HighFeb 27, 2026centreon web SQL injectionCVE-2026-2751Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24.
- 9.8CriticalJan 5, 2026Centreon awie SQL injectionCVE-2025-15029Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.13% likely
- 9.8CriticalJan 5, 2026Centreon awie Auth bypass / access controlCVE-2025-15026Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.3, from 24.04.0 before 24.04.3.
- 6.8MediumJan 5, 2026centreon web XSSCVE-2025-12513Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Stored XSS to users with high privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19.
- 6.8MediumJan 5, 2026Centreon dynamic service management XSSCVE-2025-12511Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configuration modules) allows Stored XSS to user with elevated privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.1, from 24.10.0 before 24.10.4, from 24.04.0 before 24.04.8.
- 6.8MediumJan 5, 2026centreon web XSSCVE-2025-13056Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu configuration modules) allows Stored XSS to users with high privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19.
- 5.3MediumJan 5, 2026centreon web Auth bypass / access controlCVE-2025-12519Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement configurations. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19.
- 7.2HighJan 5, 2026centreon web Code / command injectionCVE-2025-5965In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Backup configuration in the administration setup modules) allows OS Command Injection.This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19.28% likely
- 6.8MediumDec 22, 2025Centreon open tickets XSSCVE-2025-8460Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Notification rules, Open tickets module) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4.
- 6.8MediumDec 22, 2025centreon web XSSCVE-2025-54890Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration page) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19, from 23.10.0 before 23.10.29.
- 7.2HighDec 22, 2025Centreon open tickets SQL injectionCVE-2025-12514Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-tickets (Notification rules configuration parameters, Open tickets modules) allows SQL Injection to user with elevated privileges.This issue affects Infra Monitoring - Open-tickets: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4.
Top products
- centreon web6 CVEs in the last year
- open tickets3 CVEs in the last year, 1 critical
- Centreon3 CVEs in the last year
- awie2 CVEs in the last year, 2 critical
- web1 CVE in the last year, 1 critical
- dynamic service management1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.