p PatchFirst

PatchFirst · Latest vulnerabilities

librenms/librenms 26.5.1: known vulnerabilities

Known vulnerabilities affecting librenms/librenms 26.5.1: 2. Compare the fixes below with your installed release.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-84189

    Critical · CVSS 9.2EPSS 0.38%Fix available

    LibreNMS before 26.7.0 Stored XSS via Oxidized API

    LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at an attacker-controlled server (SSRF) can cause it to return malicious JSON, resulting in stored/persistent cross-site scripting affecting all users who view any device's showconfig tab. Fixed in 26.7.0.

    librenms/librenmsPHP
    • Update to 26.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-84188

    Medium · CVSS 4.8EPSS 0.25%Fix available

    librenms before 26.7.0 Stored XSS via graph_descr settings

    LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in version 26.7.0.

    librenms/librenmsPHP
    • Update to 26.7.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →