CVE Tools
Track your stack

Librenms/librenms

103 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Librenms/librenms, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Librenms/librenms CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Librenms/librenms CVEs per month
MonthCVEs
2024-1113
2024-121
2025-015
2025-020
2025-030
2025-040
2025-051
2025-060
2025-071
2025-081
2025-090
2025-103
2025-113
2025-121
2026-011
2026-027
2026-031
2026-040
2026-051
2026-060
2026-070
2026-084
2026-090
2026-100

Severity

How the 103 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical88%
  • High2121%
  • Medium6667%
  • Low33%

Latest CVEs

The 15 most recently published vulnerabilities affecting Librenms/librenms.

  1. GHSA-7w8c-qgxg-m7jxLibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates—
  2. GHSA-7gww-x7fh-jf9jLibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page—
  3. GHSA-7cj5-v4pp-v632LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users—
  4. GHSA-jf24-8g2h-2wg7LibreNMS Vulnerable to Remote Code Execution via AboutController—
  5. CVE-2024-51092LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's ...9.1
  6. GHSA-pr3g-phhr-h8fhLibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write—
  7. CVE-2026-26992LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups name4.8
  8. CVE-2026-26991LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups name4.8
  9. CVE-2026-27016LibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags()5.4
  10. CVE-2026-26990LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php8.8
  11. CVE-2026-26989LibreNMS has Stored XSS in Alert Rule4.3
  12. CVE-2026-26988LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream9.1
  13. CVE-2026-26987LibreNMS affected by reflected XSS via email field6.1
  14. CVE-2020-36947LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection7.1
  15. CVE-2025-68614LibreNMS Alert Rule API Cross-Site Scripting Vulnerability4.3

Product grouping is registry-driven, with AI assist and human review. How it works