CVE Tools
Track your stack

Librenms

125 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Librenms, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Librenms CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Librenms CVEs per month
MonthCVEs
2024-1113
2024-121
2025-015
2025-020
2025-030
2025-040
2025-051
2025-060
2025-071
2025-081
2025-090
2025-103
2025-113
2025-121
2026-011
2026-027
2026-030
2026-043
2026-051
2026-060
2026-070
2026-083
2026-0910
2026-107

Severity

How the 125 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical97%
  • High3025%
  • Medium7965%
  • Low32%

Latest CVEs

The 15 most recently published vulnerabilities affecting Librenms.

  1. CVE-2026-109356LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController4.3
  2. CVE-2026-109357LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header8.1
  3. CVE-2026-109355LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List6.1
  4. CVE-2026-109354LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter4.3
  5. CVE-2026-109353LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php7.1
  6. CVE-2026-109352LibreNMS before 26.9.0 Stored XSS via wireless sensor description6.1
  7. CVE-2026-108715LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php4.3
  8. CVE-2020-15875An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the searchPhrase p...5.0
  9. CVE-2026-86427LibreNMS before 26.8.0 Argument Injection via graph_title8.8
  10. CVE-2026-86426LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion9.8
  11. CVE-2026-84194LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname—
  12. CVE-2026-84193LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP—
  13. CVE-2026-84192LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data7.1
  14. CVE-2026-84191LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields6.1
  15. CVE-2026-84190LibreNMS before 26.5.0 Remote Code Execution via AboutController7.2

Product grouping is registry-driven, with AI assist and human review. How it works