Librenms vulnerabilities

Products

• Librenms 124
• Librenms/librenms 25

Newest

• librenms LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header CVE-2026-109357 9.2 CriticalOctober 12, 2026
• librenms LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController CVE-2026-109356 5.3 MediumOctober 12, 2026
• librenms LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List CVE-2026-109355 5.3 MediumOctober 12, 2026
• librenms LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter CVE-2026-109354 5.3 MediumOctober 12, 2026
• librenms LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php CVE-2026-109353 7.1 HighOctober 12, 2026
• librenms LibreNMS before 26.9.0 Stored XSS via wireless sensor description CVE-2026-109352 5.3 MediumOctober 12, 2026
• librenms LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php CVE-2026-108715 5.3 MediumOctober 11, 2026
• librenms An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges... CVE-2020-15875 5.0 MediumSeptember 13, 2026
• librenms LibreNMS before 26.8.0 Argument Injection via graph_title CVE-2026-86427 8.7 HighSeptember 7, 2026
• librenms LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion CVE-2026-86426 Public exploit 9.2 CriticalSeptember 7, 2026
• librenms LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname CVE-2026-84194 8.6 HighSeptember 1, 2026
• librenms LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP CVE-2026-84193 5.8 MediumSeptember 1, 2026
• librenms LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields CVE-2026-84191 5.3 MediumSeptember 1, 2026
• librenms LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data CVE-2026-84192 Fix available 7.1 HighAugust 26, 2026
• librenms LibreNMS Virtualisation Discovery Module RCE CVE-2026-80214 8.6 HighAugust 26, 2026
• librenms LibreNMS before 26.7.0 Stored XSS via Oxidized API CVE-2026-84189 Fix available 9.2 CriticalAugust 18, 2026
• librenms librenms before 26.7.0 Stored XSS via graph_descr settings CVE-2026-84188 Fix available 4.8 MediumAugust 18, 2026
• librenms LibreNMS before 26.5.0 Remote Code Execution via AboutController CVE-2026-84190 Fix available 8.7 HighAugust 18, 2026
• librenms LibreNMS: Remote Code Execution by Signal Alert Transportation Module CVE-2026-55182 Fix available 8.6 HighAugust 18, 2026
• librenms LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters CVE-2026-45694 Fix available 5.4 MediumAugust 12, 2026
• librenms LibreNMS: Cross-Site Scripting in ShowConfigController CVE-2026-2728 Fix available 4.6 MediumApril 13, 2026
• librenms LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write CVE-2026-6204 Fix available 8.5 HighMarch 26, 2026
• librenms LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php CVE-2026-26990 Fix available 8.8 HighFebruary 18, 2026
• librenms LibreNMS has Stored XSS in Alert Rule CVE-2026-26989 Fix available 4.3 MediumFebruary 18, 2026
• librenms LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream CVE-2026-26988 Public exploitFix available 9.3 CriticalFebruary 18, 2026
• librenms LibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags() CVE-2026-27016 Fix available 5.4 MediumFebruary 18, 2026
• librenms LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups name CVE-2026-26992 Fix available 5.1 MediumFebruary 18, 2026
• librenms LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups name CVE-2026-26991 Fix available 5.1 MediumFebruary 18, 2026
• librenms LibreNMS affected by reflected XSS via email field CVE-2026-26987 Fix available 5.3 MediumFebruary 18, 2026
• librenms LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection CVE-2020-36947 7.1 HighJanuary 27, 2026
• librenms LibreNMS Alert Rule API Cross-Site Scripting Vulnerability CVE-2025-68614 Fix available 4.3 MediumDecember 22, 2025
• librenms LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint CVE-2025-65093 Fix available 5.5 MediumNovember 18, 2025
• librenms LibreNMS has Weak Password Policy CVE-2025-65014 Fix available 3.7 LowNovember 18, 2025
• librenms LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name` CVE-2025-65013 Fix available 6.2 MediumNovember 18, 2025
• librenms LibreNMS alert-rules Cross-Site Scripting Vulnerability CVE-2025-62412 Fix available 3.8 LowOctober 16, 2025
• librenms Stored XSS in Alert Transport name field in LibreNMS CVE-2025-62411 Fix available EPSS 12.7% 5.5 MediumOctober 16, 2025
• librenms LibreNMS vulnerable to Reflected-XSS in `report_this` function CVE-2025-62365 Fix available 5.5 MediumOctober 13, 2025
• librenms LibreNMS allows stored XSS in Alert Template name field CVE-2025-55296 Fix available EPSS 17.0% 5.5 MediumAugust 18, 2025
• librenms LibreNMS has Authenticated Local File Inclusion in ajax_form.php that Allows RCE CVE-2025-54138 Fix available 7.5 HighJuly 21, 2025
• librenms LibreNMS stored Cross-site Scripting vulnerability in poller group name CVE-2025-47931 Fix available EPSS 10.1% 2.1 LowMay 17, 2025
• librenms Reflected Cross-site Scripting on error alert in librenms CVE-2025-23201 Fix available 5.4 MediumJanuary 16, 2025
• librenms Stored XSS-LibreNMS-Misc Section in librenms CVE-2025-23200 Fix available EPSS 31.6% 4.6 MediumJanuary 16, 2025
• librenms Stored XSS-LibreNMS-Ports in librenms CVE-2025-23199 Fix available 4.6 MediumJanuary 16, 2025
• librenms Stored-XSS-LibreNMS-Display-Name in librenms CVE-2025-23198 Fix available 4.6 MediumJanuary 16, 2025
• librenms Stored XSS-LibreNMS-Display Name 2 in librenms CVE-2024-56144 Fix available 4.6 MediumJanuary 16, 2025
• librenms LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section CVE-2024-53457 Fix available EPSS 46.4% 5.4 MediumDecember 5, 2024
• librenms LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php CVE-2024-52526 Fix available 4.8 MediumNovember 15, 2024
• librenms LibreNMS has an Authenticated OS Command Injection CVE-2024-51092 Public exploitFix available 9.1 CriticalNovember 15, 2024
• librenms LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php CVE-2024-51497 Fix available 4.8 MediumNovember 15, 2024
• librenms LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php CVE-2024-51496 Fix available 4.8 MediumNovember 15, 2024
• Show olderLoading…