Netbox

This hub aggregates every CVE we track for Netbox, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Netbox.

• CVE-2026-86176NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs4.3Sep 5, 2026
• CVE-2026-86175NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs6.5Sep 5, 2026
• CVE-2026-69117NetBox 4.5.8 ORM Injection via WritableNestedSerializer6.5Aug 11, 2026
• CVE-2026-29514NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin8.8May 4, 2026
• CVE-2025-57543Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the web UI when viewed by other users. Thi...6.1Mar 16, 2026
• CVE-2025-69848NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the Pro...5.4Feb 3, 2026
• CVE-2024-56915Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget.6.5Jun 26, 2025
• CVE-2024-56917Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance mode.7.1Jun 24, 2025
• CVE-2024-56918In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user input from the login form.6.1Jun 24, 2025
• CVE-2024-56916In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticate...6.1Jun 24, 2025
• CVE-2024-47226A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated u...5.4Sep 22, 2024
• CVE-2024-40737A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-ports/add.6.1Jul 9, 2024
• CVE-2024-40735A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/{...6.1Jul 9, 2024
• CVE-2024-40731A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/{id}...6.1Jul 9, 2024
• CVE-2024-40742A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the circuit ID parameter at /circuits/circu...6.1Jul 9, 2024