SEC.co
Emergency

By vendor

Netdata vulnerabilities

Known CVEs affecting Netdata products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2025-71385MEDIUM 6.1

    Netdata versions before 2.3.1 contain a reflected cross-site scripting (XSS) vulnerability in two undocumented SVG endpoints. These endpoints (`/api/v2/ilove.svg` and `/api/v3/ilove.svg`) accept a user-supplied `love` query parameter and insert it directly into an SVG document without any sanitization. An attacker can craft a malicious URL containing JavaScript code, and when a victim visits that URL, the script executes in their browser with access to the Netdata instance's origin. Because these endpoints are accessible without authentication on default Netdata deployments, no special access is required to exploit this vulnerability.