# cve.now: Librenms

The newest entries naming Librenms as an affected vendor (up to 200), of 95 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109357](https://cve.now/CVE-2026-109357.md): LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header (CVSS 9.2)
- [CVE-2026-109356](https://cve.now/CVE-2026-109356.md): LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController (CVSS 5.3)
- [CVE-2026-109355](https://cve.now/CVE-2026-109355.md): LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List (CVSS 5.3)
- [CVE-2026-109354](https://cve.now/CVE-2026-109354.md): LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter (CVSS 5.3)
- [CVE-2026-109353](https://cve.now/CVE-2026-109353.md): LibreNMS before 26.9.0 SQL Injection via notification\_id in notifications.inc.php (CVSS 7.1)
- [CVE-2026-109352](https://cve.now/CVE-2026-109352.md): LibreNMS before 26.9.0 Stored XSS via wireless sensor description (CVSS 5.3)
- [CVE-2026-108715](https://cve.now/CVE-2026-108715.md): LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php (CVSS 5.3)
- [CVE-2020-15875](https://cve.now/CVE-2020-15875.md): An issue was discovered in LibreNMS 1.65. (CVSS 5.0)
- [CVE-2026-86427](https://cve.now/CVE-2026-86427.md): LibreNMS before 26.8.0 Argument Injection via graph\_title (CVSS 8.7)
- [CVE-2026-86426](https://cve.now/CVE-2026-86426.md): LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion (CVSS 9.2)
- [CVE-2026-84194](https://cve.now/CVE-2026-84194.md): LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname (CVSS 8.6)
- [CVE-2026-84193](https://cve.now/CVE-2026-84193.md): LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP (CVSS 5.8)
- [CVE-2026-84192](https://cve.now/CVE-2026-84192.md): LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data (CVSS 7.1)
- [CVE-2026-84191](https://cve.now/CVE-2026-84191.md): LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields (CVSS 5.3)
- [CVE-2026-84190](https://cve.now/CVE-2026-84190.md): LibreNMS before 26.5.0 Remote Code Execution via AboutController (CVSS 8.7)
- [CVE-2026-84189](https://cve.now/CVE-2026-84189.md): LibreNMS before 26.7.0 Stored XSS via Oxidized API (CVSS 9.2)
- [CVE-2026-84188](https://cve.now/CVE-2026-84188.md): librenms before 26.7.0 Stored XSS via graph\_descr settings (CVSS 4.8)
- [CVE-2026-55182](https://cve.now/CVE-2026-55182.md): LibreNMS: Remote Code Execution by Signal Alert Transportation Module (CVSS 8.6)
- [CVE-2026-45694](https://cve.now/CVE-2026-45694.md): LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters (CVSS 5.4)
- [CVE-2026-80214](https://cve.now/CVE-2026-80214.md): LibreNMS Virtualisation Discovery Module RCE (CVSS 8.6)
- [CVE-2026-6204](https://cve.now/CVE-2026-6204.md): LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config (CVSS 8.5)
- [CVE-2026-2728](https://cve.now/CVE-2026-2728.md): LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. (CVSS 4.6)
- [CVE-2026-26992](https://cve.now/CVE-2026-26992.md): LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups name (CVSS 5.1)
- [CVE-2026-26991](https://cve.now/CVE-2026-26991.md): LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups name (CVSS 5.1)
- [CVE-2026-27016](https://cve.now/CVE-2026-27016.md): LibreNMS has Stored XSS in Custom OID - unit parameter missing strip\_tags() (CVSS 5.4)
- [CVE-2026-26990](https://cve.now/CVE-2026-26990.md): LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php (CVSS 8.8)
- [CVE-2026-26989](https://cve.now/CVE-2026-26989.md): LibreNMS has Stored XSS in Alert Rule (CVSS 4.3)
- [CVE-2026-26988](https://cve.now/CVE-2026-26988.md): LibreNMS: SQL Injection in ajax\_table.php spreads through a covert data stream (CVSS 9.3)
- [CVE-2026-26987](https://cve.now/CVE-2026-26987.md): LibreNMS affected by reflected XSS via email field (CVSS 5.3)
- [CVE-2020-36947](https://cve.now/CVE-2020-36947.md): LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection (CVSS 7.1)
- [CVE-2025-68614](https://cve.now/CVE-2025-68614.md): LibreNMS Alert Rule API Cross-Site Scripting Vulnerability (CVSS 4.3)
- [CVE-2025-65093](https://cve.now/CVE-2025-65093.md): LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax\_output.php endpoint (CVSS 5.5)
- [CVE-2025-65014](https://cve.now/CVE-2025-65014.md): LibreNMS has Weak Password Policy (CVSS 3.7)
- [CVE-2025-65013](https://cve.now/CVE-2025-65013.md): LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint \`/maps/nodeimage\` parameter \`Image Name\` (CVSS 6.2)
- [CVE-2025-62412](https://cve.now/CVE-2025-62412.md): LibreNMS alert-rules Cross-Site Scripting Vulnerability (CVSS 3.8)
- [CVE-2025-62411](https://cve.now/CVE-2025-62411.md): Stored XSS in Alert Transport name field in LibreNMS (CVSS 5.5)
- [CVE-2025-62365](https://cve.now/CVE-2025-62365.md): LibreNMS vulnerable to Reflected-XSS in \`report\_this\` function (CVSS 5.5)
- [CVE-2025-55296](https://cve.now/CVE-2025-55296.md): LibreNMS allows stored XSS in Alert Template name field (CVSS 5.5)
- [CVE-2025-54138](https://cve.now/CVE-2025-54138.md): LibreNMS has Authenticated Local File Inclusion in ajax\_form.php that Allows RCE (CVSS 7.5)
- [CVE-2025-47931](https://cve.now/CVE-2025-47931.md): LibreNMS stored Cross-site Scripting vulnerability in poller group name (CVSS 2.1)
- [CVE-2024-56144](https://cve.now/CVE-2024-56144.md): Stored XSS-LibreNMS-Display Name 2 in librenms (CVSS 4.6)
- [CVE-2025-23198](https://cve.now/CVE-2025-23198.md): Stored-XSS-LibreNMS-Display-Name in librenms (CVSS 4.6)
- [CVE-2025-23199](https://cve.now/CVE-2025-23199.md): Stored XSS-LibreNMS-Ports in librenms (CVSS 4.6)
- [CVE-2025-23200](https://cve.now/CVE-2025-23200.md): Stored XSS-LibreNMS-Misc Section in librenms (CVSS 4.6)
- [CVE-2025-23201](https://cve.now/CVE-2025-23201.md): Reflected Cross-site Scripting on error alert in librenms (CVSS 5.4)
- [CVE-2024-52526](https://cve.now/CVE-2024-52526.md): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php (CVSS 4.8)
- [CVE-2024-51497](https://cve.now/CVE-2024-51497.md): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php (CVSS 4.8)
- [CVE-2024-51496](https://cve.now/CVE-2024-51496.md): LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php (CVSS 4.8)
- [CVE-2024-51495](https://cve.now/CVE-2024-51495.md): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php (CVSS 4.8)
- [CVE-2024-51494](https://cve.now/CVE-2024-51494.md): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php (CVSS 4.8)
- [CVE-2024-50355](https://cve.now/CVE-2024-50355.md): LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints (CVSS 4.8)
- [CVE-2024-50352](https://cve.now/CVE-2024-50352.md): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php (CVSS 4.8)
- [CVE-2024-50351](https://cve.now/CVE-2024-50351.md): LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php (CVSS 4.8)
- [CVE-2024-50350](https://cve.now/CVE-2024-50350.md): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php (CVSS 4.8)
- [CVE-2024-49764](https://cve.now/CVE-2024-49764.md): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php (CVSS 4.8)
- [CVE-2024-49759](https://cve.now/CVE-2024-49759.md): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php (CVSS 4.8)
- [CVE-2024-49758](https://cve.now/CVE-2024-49758.md): LibreNMS has a stored XSS in ExamplePlugin with Device's Notes (CVSS 4.8)
- [CVE-2024-49754](https://cve.now/CVE-2024-49754.md): LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php (CVSS 7.5)
- [CVE-2024-47523](https://cve.now/CVE-2024-47523.md): LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature (CVSS 7.5)
- [CVE-2024-47524](https://cve.now/CVE-2024-47524.md): LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name (CVSS 7.2)
- [CVE-2024-47525](https://cve.now/CVE-2024-47525.md): Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php (CVSS 7.5)
- [CVE-2024-47526](https://cve.now/CVE-2024-47526.md): LibreNMS has a Self-XSS ('Cross-site Scripting') in librenms/includes/html/modal/alert\_template.inc.php (CVSS 3.5)
- [CVE-2024-47527](https://cve.now/CVE-2024-47527.md): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device-dependencies.inc.php (CVSS 7.5)
- [CVE-2024-47528](https://cve.now/CVE-2024-47528.md): LibreNMS Contains a Stored XSS via File Upload (CVSS 4.6)
- [CVE-2024-32480](https://cve.now/CVE-2024-32480.md): LibreNMS's Time-Based Blind SQL injection leads to database extraction (CVSS 7.2)
- [CVE-2024-32479](https://cve.now/CVE-2024-32479.md): LibreNMS's Improper Sanitization on Service template name leads to Stored XSS (CVSS 7.1)
- [CVE-2024-32461](https://cve.now/CVE-2024-32461.md): LibreNMS vulnerable to time-based SQL injection that leads to database extraction (CVSS 7.1)
- [CVE-2023-46745](https://cve.now/CVE-2023-46745.md): Rate limiting Bypass on login page in libreNMS (CVSS 5.3)
- [CVE-2023-48294](https://cve.now/CVE-2023-48294.md): Broken Access control on Graphs Feature in LibreNMS (CVSS 4.3)
- [CVE-2023-48295](https://cve.now/CVE-2023-48295.md): Cross-site Scripting at Device groups Deletion feature in LibreNMS (CVSS 6.3)
- [CVE-2023-5591](https://cve.now/CVE-2023-5591.md): SQL Injection in librenms/librenms (CVSS 7.8)
- [CVE-2023-5060](https://cve.now/CVE-2023-5060.md): Cross-site Scripting (XSS) - DOM in librenms/librenms (CVSS 8.4)
- [CVE-2023-4982](https://cve.now/CVE-2023-4982.md): Cross-site Scripting (XSS) - Stored in librenms/librenms (CVSS 9.8)
- [CVE-2023-4981](https://cve.now/CVE-2023-4981.md): Cross-site Scripting (XSS) - DOM in librenms/librenms (CVSS 8.8)
- [CVE-2023-4980](https://cve.now/CVE-2023-4980.md): Cross-site Scripting (XSS) - Generic in librenms/librenms (CVSS 8.8)
- [CVE-2023-4978](https://cve.now/CVE-2023-4978.md): Cross-site Scripting (XSS) - DOM in librenms/librenms (CVSS 9.0)
- [CVE-2023-4979](https://cve.now/CVE-2023-4979.md): Cross-site Scripting (XSS) - Reflected in librenms/librenms (CVSS 8.8)
- [CVE-2023-4977](https://cve.now/CVE-2023-4977.md): Code Injection in librenms/librenms (CVSS 7.3)
- [CVE-2023-4347](https://cve.now/CVE-2023-4347.md): Cross-site Scripting (XSS) - Reflected in librenms/librenms (CVSS 7.6)
- [CVE-2022-4070](https://cve.now/CVE-2022-4070.md): Insufficient Session Expiration in librenms/librenms (CVSS 2.7)
- [CVE-2022-4069](https://cve.now/CVE-2022-4069.md): Cross-site Scripting (XSS) - Generic in librenms/librenms (CVSS 3.4)
- [CVE-2022-4068](https://cve.now/CVE-2022-4068.md): Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms (CVSS 7.6)
- [CVE-2022-4067](https://cve.now/CVE-2022-4067.md): Cross-site Scripting (XSS) - Stored in librenms/librenms (CVSS 3.4)
- [CVE-2022-3562](https://cve.now/CVE-2022-3562.md): Cross-site Scripting (XSS) - Stored in librenms/librenms (CVSS 4.3)
- [CVE-2022-3561](https://cve.now/CVE-2022-3561.md): Cross-site Scripting (XSS) - Generic in librenms/librenms (CVSS 4.3)
- [CVE-2022-3525](https://cve.now/CVE-2022-3525.md): Deserialization of Untrusted Data in librenms/librenms (CVSS 9.0)
- [CVE-2022-3516](https://cve.now/CVE-2022-3516.md): Cross-site Scripting (XSS) - Stored in librenms/librenms (CVSS 5.7)
- [CVE-2022-3231](https://cve.now/CVE-2022-3231.md): Cross-site Scripting (XSS) - Stored in librenms/librenms (CVSS 5.6)
- [CVE-2022-0772](https://cve.now/CVE-2022-0772.md): Cross-site Scripting (XSS) - Stored in librenms/librenms (CVSS 4.7)
- [CVE-2022-0589](https://cve.now/CVE-2022-0589.md): Cross-site Scripting (XSS) - Stored in librenms/librenms (CVSS 5.4)
- [CVE-2022-0588](https://cve.now/CVE-2022-0588.md): Missing Authorization in librenms/librenms (CVSS 7.1)
- [CVE-2022-0587](https://cve.now/CVE-2022-0587.md): Improper Authorization in librenms/librenms (CVSS 7.1)
- [CVE-2022-0580](https://cve.now/CVE-2022-0580.md): Incorrect Authorization in librenms/librenms (CVSS 7.1)
- [CVE-2022-0575](https://cve.now/CVE-2022-0575.md): Cross-site Scripting (XSS) - Stored in librenms/librenms (CVSS 5.4)
- [CVE-2022-0576](https://cve.now/CVE-2022-0576.md): Cross-site Scripting (XSS) - Generic in librenms/librenms (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/librenms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.