Vulnerabilities

TI-2026-84457 CVE-2026-116845 · GHSA-5rfv-8fqh-fwgx

Broken access control in NetBox bulk component creation

MEDIUM 57

NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00355 Published 2026-11-03 Fixed in 4.7.4 CWE-863

TI-2026-68595 CVE-2026-104073 · GHSA-hwq6-cq8c-9m9m

Template injection in NetBox custom links leaks session cookies

LOW 30

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other user…

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00365 Published 2026-10-06 Fixed in 4.7.0 CWE-668

TI-2026-39924 CVE-2026-55251

Code injection in netbox-community devicetype-library

HIGH 68

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00127 Published 2026-10-01 No fix listed CWE-494

TI-2026-39687 CVE-2026-54918

Server-side request forgery in netbox-community devicetype-library

LOW 24

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00415 Published 2026-09-17 Fixed in 8980c69 CWE-15

TI-2026-39685 CVE-2026-54916

Uncontrolled search path in netbox-community devicetype-library

MEDIUM 41

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00611 Published 2026-09-17 No fix listed CWE-427

TI-2026-39558 CVE-2026-54752

Deserialization of untrusted data in netbox-community devicetype-library

HIGH 76

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0066 Published 2026-09-17 Fixed in 1c6f7e2 CWE-502

TI-2026-58965 CVE-2026-86176 · GHSA-mx7r-5p73-mr7p

NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

LOW 24

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-09-05 No fix listed CWE-639

TI-2026-58964 CVE-2026-86175 · GHSA-2fj3-v6qr-qf3j

NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

MEDIUM 64

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00464 Published 2026-09-05 No fix listed CWE-522

TI-2026-23330 CVE-2026-29514 · GHSA-f249-4qx6-hg68

NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin

HIGH 73

NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissio…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00782 Published 2026-05-04 No fix listed CWE-183

Vulnerabilities

Filters