These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
LibreNMS before 26.9.0 contains an LDAP filter injection vulnerability in ldap-authorization and ad-authorization modes. Unauthenticated attackers can send a wildcard username via HTTP Basic Authorization to match all users and groups, gaining admin access. This vulnerability allows attackers to bypass authentication and gain elevated privileges. System administrators should assess exposure and prioritize [truncated]
LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. This vulnerability affects LibreNMS installations with global-read user accounts, potentially allowing unauthorized port deletion via PortsController::purge. Administrators should assess exposure and verify inventory to mitigate [truncated]
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the Tools Oxidized page. This vulnerability allows for potential script injection, impacting defenders who vie [truncated]
LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. This vulnerability can be exploited by attackers with access to one NFSen-enabled device, who can request graph.php with a traversed channel value to view traffic and NetFlow graphs of devices out [truncated]
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface. This vulnerability has a high severity score and requires immediate a [truncated]
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored device's SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authentic [truncated]
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in Smokeping Graph auth.inc.php, allowing restricted users on a probe device to request smokeping_in or smokeping_out graphs with arbitrary device ids, thereby viewing latency data and enumerating device names. This issue arises from the flawed logic that checks the src probe device instead of the rendered target device, potentially [truncated]
CVE-2026-86427 is an argument injection vulnerability in LibreNMS before 26.8.0, allowing authenticated attackers to inject arbitrary rrdtool arguments. This vulnerability can be used to read RRD files from unauthorized devices or execute arbitrary rrdtool commands, bypassing per-device authorization checks. The vulnerability is caused by a lack of proper input validation in the graph_title parameter of L [truncated]
CVE-2026-86426 is a critical authentication bypass vulnerability in LibreNMS before version 26.8.0. The vulnerability allows unauthenticated attackers to access protected REST API endpoints by exploiting MySQL type coercion. This can lead to unauthorized access to device credentials and administrative features, potentially enabling remote code execution through alert templates.
LibreNMS versions >= 23.10.0 and < 26.2.0 contain an authenticated OS command injection vulnerability in libvirt discovery. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands, leading to remote code execution in the discovery worker context. This vulnerability exists due to improper handling of user input in the libvirt discovery feature. The affected product context [truncated]
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog program fields that executes when authenticated users view affected pages.
LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell_exec() without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable file and trigger code execution by accessing the /about endpoint.
LibreNMS through version 26.4.0 is vulnerable to stored cross-site scripting via the Oxidized integration URL. An administrator who points the Oxidized URL at an attacker-controlled server can cause it to return malicious JSON, resulting in persistent XSS affecting all users who view any device's showconfig tab. The issue is fixed in version 26.7.0. Affected systems should be updated to prevent exploitati [truncated]
LibreNMS versions less than or equal to 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr settings. An administrator can exploit this by storing a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type, potentially leading to malicious payload execution. The issue is fixed in version 26.7.0, and defenders should assess ex [truncated]
CVE-2026-55182 is a high-severity vulnerability in LibreNMS, a network monitoring system. An authenticated administrator can exploit this issue to execute arbitrary operating-system commands on the LibreNMS host by crafting a transport entry with shell metacharacters and pointing to a vulnerable script. The issue is fixed in version 26.5.0. This vulnerability allows for potential lateral movement within t [truncated]
CVE-2026-45694 is a reflected cross-site scripting vulnerability in LibreNMS versions up to and including 26.4.0. The vulnerability exists in the Proxmox application view and can be exploited through user-supplied instance and vmid GET parameters. An attacker can execute script in an authenticated user's session by luring them into following a crafted link, enabling actions such as theft of session data. [truncated]
CVE-2020-15878 is an authenticated SQL injection vulnerability in LibreNMS 1.65. The vulnerability exists in the address parameter of the /ajax_table.php API endpoint. An attacker with normal privileges can exploit this vulnerability to extract all information from the LibreNMS database, potentially leading to unauthorized data access and manipulation. Affected product deployments should be identified and [truncated]
CVE-2020-15876 is a SQL injection vulnerability in LibreNMS 1.65. An authenticated attacker with normal privileges can exploit this via the sort parameter in the /ajax_table.php API endpoint, affecting multiple components. The CVSS score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). This vulnerability allows attackers to extract all information from the LibreNMS database. Administrators and users [truncated]
CVE-2020-15874 is an authenticated command injection vulnerability in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through the /graph.php API endpoint. The vulnerability has a CVSS score of 8.8 and is classified as HIGH severity. This type of vulnerability can allow attackers to gain unauthorized access to sensitive data or disrupt service. Aff [truncated]
LibreNMS's Virtualization Discovery module has a high-severity vulnerability (CVE-2026-80214) that allows authenticated admin users to execute arbitrary code via command line injection. This vulnerability has a CVSS score of 8.6 and requires immediate attention from admin users, security teams, and IT staff. The CVE record was published on 2026-08-26T05:18:28.127Z and has not been modified since then. Evi [truncated]
LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL injection techniques to retrieve sensitive database contents through time-based blind SQL injection. This vulnerability allows attackers to extract database information, posing a risk to the confidentiality a [truncated]
