Read the docs

librenms

Records124All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical11CVSS 9.0–10.0
CVSS high32CVSS 7.0–8.9

Exploited now

librenms records in CISA KEV

No librenms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Librenms 106 records HIGH

Records

106 records in Librenms · all components

TI-2018-14479 CVE-2018-20434 · GHSA-62q7-qj6g-gvr7

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the…

Priority HIGH 80

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajax_output.php?id=captu…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.71487 Published 2019-04-24 No fix listed CWE-78
TI-2026-59134 CVE-2026-86426 · GHSA-84cr-xjpw-q9mc

LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion

Priority HIGH 75

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.04358 Published 2026-09-07 Fixed in 26.8.0 CWE-287
TI-2022-03735 CVE-2022-4070 · GHSA-x93j-3hh3-6x23

Insufficient Session Expiration in librenms/librenms

Priority HIGH 75

Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00662 Published 2022-11-20 Fixed in 22.10.0 CWE-613
TI-2022-03252 CVE-2022-3525 · GHSA-cv9g-h8mm-xx5h

Deserialization of Untrusted Data in librenms/librenms

Priority HIGH 73

Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00951 Published 2022-11-20 Fixed in 22.10.0 CWE-502
TI-2026-05445 CVE-2026-6204 · GHSA-pr3g-phhr-h8fh

OS command injection in librenms

Priority HIGH 72

LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.07533 Published 2026-04-13 Fixed in 26.3.0 CWE-78
TI-2024-34235 CVE-2024-51092 · GHSA-x645-6pf9-xwxw

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command…

Priority HIGH 72

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory().

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.07176 Published 2026-05-08 Fixed in 24.10.0 CWE-78
TI-2023-25228 CVE-2023-46745 · GHSA-rq42-58qf-v3qx

Rate limiting Bypass on login page in libreNMS

Priority HIGH 72

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00599 Published 2023-11-17 Fixed in 23.11.0 CWE-307
TI-2022-03732 CVE-2022-4067 · GHSA-qch4-jmf8-xvp7

Cross-site Scripting (XSS) - Stored in librenms/librenms

Priority HIGH 68

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.93712 Published 2022-11-20 Fixed in 22.10.0 CWE-79
TI-2022-03278 CVE-2022-3562 · GHSA-5h77-4245-pg5p

Cross-site Scripting (XSS) - Stored in librenms/librenms

Priority HIGH 68

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.94216 Published 2022-11-20 Fixed in 22.10.0 CWE-79
TI-2022-03734 CVE-2022-4069 · GHSA-p55m-g4m3-qmrp

Cross-site Scripting (XSS) - Generic in librenms/librenms

Priority HIGH 66

Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.93343 Published 2022-11-20 Fixed in 22.10.0 CWE-79
TI-2020-19082 CVE-2020-36947 · GHSA-qp2j-v5jg-hg68

LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection

Priority MEDIUM 64

LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00474 Published 2026-01-27 No fix listed CWE-89
TI-2023-05147 CVE-2023-5591 · GHSA-mr6h-7x2m-rgmq

SQL Injection in librenms/librenms

Priority MEDIUM 62

SQL Injection in GitHub repository librenms/librenms prior to 23.10.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.23762 Published 2023-10-16 Fixed in 23.10.0 CWE-89
TI-2023-26158 CVE-2023-48295 · GHSA-8phr-637g-pxrg

Cross-site Scripting at Device groups Deletion feature in LibreNMS

Priority MEDIUM 61

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00562 Published 2023-11-17 Fixed in 23.11.0 CWE-79
Load more
Open these records in search →