Search results

For cacti_snmp_walk, use of $host['max_oids'] should instead be $host['bulk_walk_size']

Status: Open.

#7493 In Cacti/cacti;

· BurnHavoc opened on Jul 28, 2026

package_import.php uses a predictable rand()-based temp filename on develop -- release/1.2.31's tempnam() fix never forward-ported

bugUndesired behaviourUndesired behaviour

SECURITYA security issue reported through CVEA security issue reported through CVE

Status: Open.

#7492 In Cacti/cacti;

· somethingwithproof opened on Jul 28, 2026

html_make_device_where() filters host_template_id against the wrong column (develop only, functional bug)

bugUndesired behaviourUndesired behaviour

Status: Open.

#7491 In Cacti/cacti;

· somethingwithproof opened on Jul 28, 2026

graphs.php template_id filter still uses an unanchored regex a sibling hardening pass replaced elsewhere (both branches, functional/hardening bug)

bugUndesired behaviourUndesired behaviour

Status: Open.

#7490 In Cacti/cacti;

· somethingwithproof opened on Jul 28, 2026

Package 'homepage' metadata rendered unescaped in import preview table (develop only, sibling of GHSA-qvxq-j576-3p74)

bugUndesired behaviourUndesired behaviour

SECURITYA security issue reported through CVEA security issue reported through CVE

Status: Open.

#7489 In Cacti/cacti;

· somethingwithproof opened on Jul 28, 2026

Unvalidated plugin_config.directory reaches require_once() via cli/audit_database.php --upgrade (develop only, sibling of GHSA-cx8g-hvq8-p2rv)

bugUndesired behaviourUndesired behaviour

SECURITYA security issue reported through CVEA security issue reported through CVE

Status: Open.

#7488 In Cacti/cacti;

· somethingwithproof opened on Jul 28, 2026

Local File Inclusion sibling in index.php's render_external_links() (develop only, sibling of GHSA-pfh9-gwm6-86vp)

bugUndesired behaviourUndesired behaviour

SECURITYA security issue reported through CVEA security issue reported through CVE

Status: Open.

#7487 In Cacti/cacti;

· somethingwithproof opened on Jul 28, 2026

Stored XSS: external-link fileurl unescaped in index.php console iframe src (develop regression, sibling of GHSA-wh9c-v56x-v77c)

bugUndesired behaviourUndesired behaviour

SECURITYA security issue reported through CVEA security issue reported through CVE

Status: Open.

#7486 In Cacti/cacti;

· somethingwithproof opened on Jul 28, 2026

Control-character-blocking SNMP community validator exists and is unit-tested but is never called (develop only, sibling of GHSA-c7rr-2h93-7gjf)

bugUndesired behaviourUndesired behaviour

Status: Open.

#7485 In Cacti/cacti;

· somethingwithproof opened on Jul 28, 2026

Unescaped output regressions in auth_changepassword.php and auth_display_custom_error_message() (sibling of GHSA-4m4r-c84q-p779)

bugUndesired behaviourUndesired behaviour

SECURITYA security issue reported through CVEA security issue reported through CVE

Status: Open.

#7484 In Cacti/cacti;

· somethingwithproof opened on Jul 28, 2026

Uncaught RuntimeException crashes 2FA enrollment when HTTP_HOST contains a colon (develop only)

bugUndesired behaviourUndesired behaviour

Status: Open.

#7483 In Cacti/cacti;

· somethingwithproof opened on Jul 28, 2026

Unvalidated deserialized array keys crash create_save_graph() via PHP 8 type-hint mismatch (develop only)

bugUndesired behaviourUndesired behaviour

Status: Open.

#7482 In Cacti/cacti;

· somethingwithproof opened on Jul 28, 2026