Netbox-community vulnerabilities

Products

• Netbox 10
• Devicetype-library 4

Newest

• netbox-community netbox NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView CVE-2026-116845 5.3 MediumNovember 3, 2026
• netbox-community netbox NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links CVE-2026-104073 6.9 MediumOctober 6, 2026
• netbox-community devicetype-library NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files CVE-2026-55251 6.5 MediumOctober 1, 2026
• netbox-community devicetype-library NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI CVE-2026-54918 5.3 MediumSeptember 17, 2026
• netbox-community devicetype-library NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft CVE-2026-54916 8.8 HighSeptember 17, 2026
• netbox-community devicetype-library NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request CVE-2026-54752 9.6 CriticalSeptember 17, 2026
• netbox-community netbox NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs CVE-2026-86176 5.3 MediumSeptember 5, 2026
• netbox-community netbox NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs CVE-2026-86175 7.1 HighSeptember 5, 2026
• netbox labs netbox NetBox 4.5.8 ORM Injection via WritableNestedSerializer CVE-2026-69117 7.1 HighAugust 11, 2026
• netbox-community netbox NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin CVE-2026-29514 8.7 HighMay 4, 2026
• netbox-community netbox-docker netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for... CVE-2023-27573 9.0 CriticalMarch 11, 2026
• carrier lenels2 netbox, lenels2 netbox +1 more LenelS2 NetBox Improper Neutralization of Argumented Delimiters CVE-2024-2422 9.3 CriticalMay 30, 2024
• carrier lenels2 netbox, lenels2 netbox +1 more LenelS2 NetBox Improper Neutralization of Special Elements CVE-2024-2421 9.3 CriticalMay 30, 2024
• carrier lenels2 netbox, lenels2 netbox +1 more LenelS2 NetBox Hardcoded Credentials CVE-2024-2420 8.8 HighMay 30, 2024
• netbox NetBox Home Page Configuration config-revisions cross site scripting CVE-2024-0948 Disputed 2.4 LowJanuary 26, 2024