Librenms vulnerabilities
95 CVEs and advisories name Librenms as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-109357LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header
- CVE-2026-109356LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController
- CVE-2026-109355LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List
- CVE-2026-109354LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter
- CVE-2026-109353LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php
- CVE-2026-109352LibreNMS before 26.9.0 Stored XSS via wireless sensor description
- CVE-2026-108715LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php
- CVE-2020-15875An issue was discovered in LibreNMS 1.65.
- CVE-2026-86427LibreNMS before 26.8.0 Argument Injection via graph_title
- CVE-2026-86426LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion
- CVE-2026-84194LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname
- CVE-2026-84193LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP
- CVE-2026-84192LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data
- CVE-2026-84191LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields
- CVE-2026-84190LibreNMS before 26.5.0 Remote Code Execution via AboutController
- CVE-2026-84189LibreNMS before 26.7.0 Stored XSS via Oxidized API
- CVE-2026-84188librenms before 26.7.0 Stored XSS via graph_descr settings
- CVE-2026-55182LibreNMS: Remote Code Execution by Signal Alert Transportation Module
- CVE-2026-45694LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters
- CVE-2026-80214LibreNMS Virtualisation Discovery Module RCE
- CVE-2026-6204LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config
- CVE-2026-2728LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page.
- CVE-2026-26992LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups name
- CVE-2026-26991LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups name
- CVE-2026-27016LibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags()
- CVE-2026-26990LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php
- CVE-2026-26989LibreNMS has Stored XSS in Alert Rule
- CVE-2026-26988LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream
- CVE-2026-26987LibreNMS affected by reflected XSS via email field
- CVE-2020-36947LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection