Known vulnerabilities in LibreNMS

Vendor: LibreNMS Project
Software: LibreNMS
Software CPE: cpe:2.3:a:librenms_project:librenms:*:*:*:*:*:*:*:*
Website: https://github.com/librenms
Total vulnerabilities: 71
Public exploits: 10
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting LibreNMS LibreNMS is affected by 71 known vulnerabilities: 4 high, 12 medium, 55 low Critical High Medium Low

Vulnerabilities (71)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU140844 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
 CWE-78 Low
No
No
 26.4.0 04.08.2026 SB2026080414
#VU140843 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 26.3.0 04.08.2026 SB2026042417
#VU140841 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Medium
No
No
 26.5.0 04.08.2026 SB2026061542
#VU140842 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Medium
No
No
 26.5.0 04.08.2026 SB2026061542
#VU140839 - Command injection
 CWE-77 Low
No
No
 26.4.1 04.08.2026 SB2026080413
#VU140840 - Improper input validation
 CWE-20 Low
No
No
 26.4.1 04.08.2026 SB2026080413
#VU140838 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
 CWE-78 Low
No
No
 26.5.0 04.08.2026 SB2026061542
#VU140837 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 26.7.0 04.08.2026 SB2026080412
#VU140836 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45694		 CWE-79 Low
No
No
 26.5.0 04.08.2026 SB2026061542
#VU140835 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 26.7.0 04.08.2026 SB2026080412
#VU134531 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Medium
No
No
 26.3.1 15.06.2026 SB2026061543
#VU134530 - Command injection
 CWE-77 Low
No
No
 26.5.0 15.06.2026 SB2026061542
#VU131713 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-2728		 CWE-79 Low
No
No
 26.3.0 18.05.2026 SB2026042417
#VU127456 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-6204		 CWE-78 Low
No
No
 26.3.0 24.04.2026 SB2026042417
#VU127445 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-47931		 CWE-79 Low
No
No
 25.5.0 24.04.2026 SB2026042416
#VU127443 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62365		 CWE-79 Medium
No
No
 25.7.0 24.04.2026 SB2026042415
#VU127442 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-54138		 CWE-98 Low
No
No
 25.7.0 24.04.2026 SB2026042415
#VU127441 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-55296		 CWE-79 Low
No
No
 25.8.0 24.04.2026 SB2026042414
#VU127440 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62411		 CWE-79 Low
No
No
 25.10.0 24.04.2026 SB2026042413
#VU127439 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62412		 CWE-79 Low
No
No
 25.10.0 24.04.2026 SB2026042413


Showing elements 1 - 20 out of 71