Product by LibreNMS
LibreNMS
124 known vulnerabilities in LibreNMS (LibreNMS), 0 of them actively exploited (CISA KEV).
Key figures
124
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
14
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-86426 | LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion | 9.8 | |
| Critical | CVE-2024-51092 | LibreNMS: OS Command Injection | 9.1 | |
| Critical | CVE-2026-26988 | LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream | 9.1 | |
| High | CVE-2026-6204 | LibreNMS: OS Command Injection | 7.2 | |
| Critical | CVE-2018-20434 | LibreNMS: security vulnerability | 9.8 | |
| High | CVE-2026-26990 | LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php | 8.8 | |
| High | CVE-2024-49754 | LibreNMS: Cross-site Scripting | 7.5 | |
| High | CVE-2024-47525 | Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php | 7.5 | |
| High | CVE-2023-4347 | Cross-site Scripting (XSS) - Reflected in librenms/librenms | 7.6 | |
| High | CVE-2023-5591 | SQL Injection in librenms/librenms | 7.8 | |
| High | CVE-2024-32479 | LibreNMS's Improper Sanitization on Service template name leads to Stored XSS | 7.1 | |
| High | CVE-2022-4068 | Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms | 7.6 | |
| High | CVE-2024-32480 | LibreNMS's Time-Based Blind SQL injection leads to database extraction | 7.2 | |
| High | CVE-2024-32461 | LibreNMS vulnerable to time-based SQL injection that leads to database extraction | 7.1 | |
| High | CVE-2019-10669 | LibreNMS: Command Injection | 7.2 | |
| Medium | CVE-2025-55296 | LibreNMS allows stored XSS in Alert Template name field | 5.5 | |
| High | CVE-2026-55182 | LibreNMS: Remote Code Execution by Signal Alert Transportation Module | — | |
| Medium | CVE-2025-62411 | Stored XSS in Alert Transport name field in LibreNMS | 5.5 | |
| Medium | CVE-2025-47931 | LibreNMS stored Cross-site Scripting vulnerability in poller group name | 6.1 | |
| High | CVE-2026-84194 | LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname | — | |
| Medium | CVE-2024-53457 | LibreNMS: Cross-Site Scripting (XSS) | 5.4 | |
| Medium | CVE-2024-50352 | LibreNMS: Cross-site Scripting | 4.8 | |
| Medium | CVE-2025-23200 | Stored XSS-LibreNMS-Misc Section in librenms | 4.6 | |
| Medium | CVE-2025-65093 | LibreNMS: SQL Injection | 5.5 | |
| Medium | CVE-2022-3562 | Cross-site Scripting (XSS) - Stored in librenms/librenms | 4.3 |