Alerta Project maintains an open-source alerting and incident-management platform that, while narrowly scoped to a single core product, serves monitoring and operations infrastructure where access control and data integrity are critical. The durable signal in its vulnerability profile centers on authentication and input-handling weaknesses, specifically improper authentication mechanisms and SQL injection flaws, which are characteristic of web-facing administrative and data-collection interfaces. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Alerta Project over time
Signals from CVEs in this vendor scope (2 CVEs).
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-26214CRITICAL In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization p | Nov 6, 2020 | 9.8 | 78 | NO | YES |
CVE-2026-34400CRITICAL Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by in | Mar 31, 2026 | 9.8 | 29 | NO | NO |
Signals from CVEs in this vendor scope (2 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Alerta Project.
Media articles that mention a CVE ID that affects a product developed by Alerta Project — matched by CVE ID, not by vendor name.