Social login provider icons are displayed correctly again We fixed an issue on the NetEye login page where icons of social login providers (identity providers configured in Keycloak) were rendered at the wrong size after the update to Keycloak 26.8. This made the login buttons look broken. The icons are now shown at a consistent…
Read MoreDisclaimer: The CVEs referenced below have not yet been publicly disclosed, so details regarding their severity, impact, and potential attack vectors are not available at this time. This post will be updated as soon as additional information becomes publicly available. Update: The CVEs referenced below have now been publicly disclosed, and additional details have been…
Read MoreImportant: ClickHouse security update Type/Severity NetEye Product Security has rated this update as having a CRITICAL security impact. Topic An update for the clickhouse-server package is now available for NetEye 4. Security Fix for NetEye 4.50: Security Fixes This vulnerability is a remote code execution flaw in ClickHouse Server. It comes from an integer overflow (CWE-190). Under…
Read MoreDisclaimer: Three of the security issues referenced below do not yet have public CVE identifiers, so they are referenced by their GHSA ID. This post will be updated as soon as CVEs become available. Important: Icinga Web 2 security update Type/Severity NetEye Product Security has rated this update as having a High security impact. Topic…
Read MoreDisclaimer: Some of the CVEs referenced below have not yet been publicly disclosed, so details regarding their severity, impact, and potential attack vectors are not fully available at this time. This post will be updated as soon as additional information becomes available. Important: Keycloak security update Type/Severity NetEye Product Security has rated this update as…
Read MoreImportant: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a High security impact. Topic Updates for the Elastic Stack packages are now available for NetEye 4. Security Fix for NetEye 4.50 CVEs Elasticsearch Kibana Logstash Logstash shares the two eMudhra trust-store CVEs listed under Elasticsearch (CVE-2026-91403, CVE-2026-114820) through its…
Read MoreUpdate: Elastic Stack v9.5.6 also includes important security fixes. You can find more details here. Update of Elastic Stack to Version 9.5.6 Elastic Stack 9.5.6 is a maintenance release that brings a large set of stability, correctness and hardening fixes across Elasticsearch, Kibana, Fleet Server, Logstash, Elastic Agent, Beats, Elastic Observability, and Elastic Security. Elasticsearch…
Read MoreDisclaimer: The security issues referenced below do not yet have publicly disclosed CVE identifiers, so they are referenced by GHSA ID. This post will be updated as soon as CVEs become available. Important: Icinga 2 security update Type/Severity NetEye Product Security has rated this update as having a Medium security impact. Topic An update for the icinga…
Read MoreDisclaimer: The security issues below do not yet have publicly disclosed CVE identifiers, so details regarding their severity, impact, and potential attack vectors are not fully available at this time. This post will be updated as soon as additional information becomes available. Important: GLPI security update Type/Severity NetEye Product Security has rated this update as…
Read MoreDisclaimer: The CVEs referenced below have not yet been publicly disclosed, so details regarding their severity, impact, and potential attack vectors are not available at this time. This post will be updated as soon as additional information becomes publicly available. Update: The CVEs referenced below have now been publicly disclosed, and additional details have been…
Read MoreAsset Management: GLPI agent inventory submissions through satellites now work with the glpiinventory plugin On NetEye satellites, nginx proxies GLPI inventory submissions from agents to the GLPI instance running on the master. Until now, the proxy covered only one endpoint, /glpi/front/inventory.php. However, agents that rely on the glpiinventory plugin may also exchange data with the…
Read MoreNagVis: honor recognize_services and exclude_members for Icinga DB hostgroups When NagVis renders a hostgroup summary object, two map options control which member states may influence the icon: The Icinga DB backend silently ignored both options, so service states were always merged into the hostgroup summary, and exclusion rules were never applied. As a result, a…
Read MoreImportant: PHP security update Type/Severity NetEye Product Security has rated this update as having a CRITICAL security impact. Topic Updates for the php and glpi packages are now available for NetEye 4. Security Fix for All NetEye Releases Security Fix for NetEye 4.50 Security Fix for NetEye 4.49 CVEs 1. CVE-2026-109618 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2. CVE-2026-109619 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H3. CVE-2026-91765 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H4. CVE-2025-14181 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H5. CVE-2026-91767 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H6. CVE-2026-91768 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N7. CVE-2026-91766 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N8. CVE-2026-92842 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N9. CVE-2026-93682 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N10. CVE-2026-6103 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N11. CVE-2026-91769 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N12. CVE-2025-1218 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L The two most severe CVEs can be triggered by an unauthenticated remote attacker who sends crafted HTTP requests to a PHP…
Read MoreImportant: Grafana security update Type/Severity NetEye Product Security has rated this update as having a Medium security impact. Topic Updates for the grafana packages are now available for NetEye 4. Security Fix for NetEye 4.50 CVEs Two of the three CVEs are reachable by any low-privileged authenticated user: an oversized request to the Prometheus rule…
Read MoreRKE2: Fix of the upgrade to NetEye 4.49 and NetEye 4.50 fresh installations During an upgrade to NetEye 4.49 or a fresh installation of NetEye 4.50, the configuration of the RKE2 service could cause PCS to report all *_virt_ip resources as failed, potentially resulting in brief service interruptions. This behavior was triggered by a routine…
Read More