Read the docs

netbox-community

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

netbox-community records in CISA KEV

No netbox-community vulnerabilities are listed in CISA KEV.

Records

9 records

TI-2026-23330 CVE-2026-29514 · GHSA-f249-4qx6-hg68

NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin

Priority HIGH 73

NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissio…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00782 Published 2026-05-04 No fix listed CWE-183
TI-2026-39924 CVE-2026-55251

Code injection in netbox-community devicetype-library

Priority HIGH 68

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00127 Published 2026-10-01 No fix listed CWE-494
TI-2026-84457 CVE-2026-116845 · GHSA-5rfv-8fqh-fwgx

Broken access control in NetBox bulk component creation

Priority MEDIUM 57

NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00355 Published 2026-11-03 Fixed in 4.7.4 CWE-863
TI-2026-68595 CVE-2026-104073 · GHSA-hwq6-cq8c-9m9m

Template injection in NetBox custom links leaks session cookies

Priority LOW 30

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other user…

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00365 Published 2026-10-06 Fixed in 4.7.0 CWE-668
TI-2026-58965 CVE-2026-86176 · GHSA-mx7r-5p73-mr7p

NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

Priority LOW 24

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-09-05 No fix listed CWE-639
Open these records in search →