LLibreNMS

Products

Exploited and recent CVEs

• CVE-2026-109357 High 8.1 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header 0.6%
• CVE-2026-109356 Medium 4.3 LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController 0.2%
• CVE-2026-109355 Medium 6.1 LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List 0.2%
• CVE-2026-109354 Medium 4.3 LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter 0.3%
• CVE-2026-109353 High 7.1 LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php 0.3%
• CVE-2026-109352 Medium 6.1 LibreNMS before 26.9.0 Stored XSS via wireless sensor description 0.2%
• CVE-2026-108715 Medium 4.3 LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php 0.3%
• CVE-2020-15875 Medium 5.0 An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the searchPhrase para 0.5%
• CVE-2026-86427 High 8.8 LibreNMS before 26.8.0 Argument Injection via graph_title 0.6%
• CVE-2026-86426 Critical 9.2 LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion 4.4%
• CVE-2026-84194 High 8.6 LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname 1.5%
• CVE-2026-84193 Medium 5.8 LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP 0.3%
• CVE-2026-84192 High 7.1 LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data 0.3%
• CVE-2026-84191 Medium 6.1 LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields 0.3%
• CVE-2026-84190 High 7.2 LibreNMS before 26.5.0 Remote Code Execution via AboutController 0.9%
• CVE-2026-84189 High 8.1 LibreNMS before 26.7.0 Stored XSS via Oxidized API 0.4%
• CVE-2026-84188 Medium 4.8 librenms before 26.7.0 Stored XSS via graph_descr settings 0.3%
• CVE-2026-55182 High 8.6 LibreNMS: Remote Code Execution by Signal Alert Transportation Module 1.6%
• CVE-2026-45694 Medium 5.4 LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters 0.2%
• CVE-2026-80214 High 8.6 LibreNMS Virtualisation Discovery Module RCE 0.5%
• CVE-2026-6204 High 8.5 LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires 7.5%
• CVE-2026-2728 Medium 4.6 LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation cou 0.2%
• CVE-2026-26992 Medium 5.1 LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups name 0.2%
• CVE-2026-26991 Medium 5.1 LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups name 0.2%
• CVE-2026-27016 Medium 5.4 LibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags() 0.3%
• CVE-2026-26990 High 8.8 LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php 4.5%
• CVE-2026-26989 Medium 4.3 LibreNMS has Stored XSS in Alert Rule 0.3%
• CVE-2026-26988 Critical 9.3 LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream 8.4%
• CVE-2026-26987 Medium 5.3 LibreNMS affected by reflected XSS via email field 0.3%
• CVE-2020-36947 High 7.1 LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection 0.5%