Log in Start free

netbox-community

Products

ProductCVEsExploitedLatest
netbox5–Nov 3, 2026
devicetype-library4–Oct 1, 2026
netbox-docker1–Mar 11, 2026

Exploited and recent CVEs

  • CVE-2026-116845 Medium 5.4 NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView 0.4%
  • CVE-2026-104073 High 7.6 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links 0.4%
  • CVE-2026-55251 Medium 6.5 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files 0.1%
  • CVE-2026-54918 Medium 5.3 NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI 0.4%
  • CVE-2026-54916 High 8.8 NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft 0.6%
  • CVE-2026-54752 Critical 9.6 NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request 0.7%
  • CVE-2026-86176 Medium 4.3 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs 0.3%
  • CVE-2026-86175 Medium 6.5 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs 0.5%
  • CVE-2026-29514 High 8.8 NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin 0.8%
  • CVE-2023-27573 Critical 9.0 netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In pract 0.6%