Log Server
Vendor:
First CVE: Sep 3, 2019 · Active for 6 years
23
Total CVEs
More Total CVEs than 95% of tracked products
5.8
Avg CVEs / Year
Higher CVE frequency than 90% of tracked products
7.0
Avg CVSS
Higher Avg CVSS than 41% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Log Server over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 3, 2019
6 years ago
Most Recent CVE
Nov 17, 2025
249 days ago
CVE Severity & Scoring
Log Server23 CVEs
57%
30%
13%
All CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local2 (8.7%)
Network21 (91.3%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low22 (95.7%)
High1 (4.3%)
Unknown0 (0.0%)
User Interaction
None13 (56.5%)
Unknown0 (0.0%)
Required10 (43.5%)
Privileges Required
Low15 (65.2%)
High2 (8.7%)
None6 (26.1%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (23 CVEs).
23 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-35478MEDIUM Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects | Jul 30, 2021 | 5.4 | 61 | NO | NO |
CVE-2025-44823HIGH Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL: | Oct 7, 2025 | 8.8 | 41 | NO | NO |
CVE-2025-29471HIGH Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field. | Apr 15, 2025 | 8.3 | 40 | NO | YES |
CVE-2025-34271CRITICAL Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted ch | Oct 30, 2025 | 9.8 | 34 | NO | NO |
CVE-2025-34277CRITICAL Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an in | Oct 30, 2025 | 9.8 | 32 | NO | NO |
CVE-2025-34274CRITICAL Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attac | Oct 30, 2025 | 9.8 | 31 | NO | NO |
CVE-2025-34298HIGH Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid val | Oct 30, 2025 | 8.8 | 28 | NO | NO |
CVE-2025-44824MEDIUM Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsys | Oct 7, 2025 | 6.5 | 27 | NO | NO |
CVE-2020-25385MEDIUM Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact user | Jan 20, 2021 | 6.1 | 27 | NO | NO |
CVE-2025-34323HIGH Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories | Nov 17, 2025 | 7.8 | 26 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (23 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
4.3% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (23 CVEs).
Media Mentions
Signals from CVEs in this product scope (23 CVEs).
Top CNAs Publishing CVEs For Log Server
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2026 | 2 | 7.5 | 2.7% | 0 | 0 |
| 2024 | 11 | 7.8 | 2.2% | 0 | 1 |