librenms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-109357 LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP seaCritical 9.2 · Oct 12, 2026
• CVE-2026-109353 LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parametHigh 7.1 · Oct 12, 2026
• CVE-2026-86427 LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtoolHigh 8.7 · Sep 7, 2026
• CVE-2026-86426 LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by seCritical 9.2 · Sep 7, 2026
• CVE-2026-84194 LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery.High 8.6 · Sep 1, 2026
• CVE-2026-84192 LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escHigh 7.1 · Sep 1, 2026
• CVE-2026-84190 LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shelHigh 8.7 · Sep 1, 2026
• CVE-2026-84189 LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url)Critical 9.2 · Sep 1, 2026
• CVE-2026-55182 LibreNMS is a network monitoring system.High 8.6 · Aug 26, 2026
• CVE-2026-80214 LibreNMS’s Virtualization Discovery module is vulnerable to command line injection.High 8.6 · Aug 26, 2026
• CVE-2024-51092 LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.Critical 9.1 · May 8, 2026
• CVE-2026-6204 LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand fHigh 8.5 · Apr 13, 2026
• CVE-2026-26990 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool.High 8.8 · Feb 19, 2026
• CVE-2026-26988 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool.Critical 9.3 · Feb 19, 2026
• CVE-2020-36947 LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database informHigh 7.1 · Jan 27, 2026
• CVE-2025-54138 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems.High 7.5 · Jul 22, 2025
• CVE-2024-49754 LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system.High 7.5 · Nov 15, 2024
• CVE-2024-47527 LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system.High 7.5 · Oct 1, 2024
• CVE-2024-47525 LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system.High 7.5 · Oct 1, 2024
• CVE-2024-47524 LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system.High 7.2 · Oct 1, 2024
• CVE-2024-47523 LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system.High 7.5 · Oct 1, 2024
• CVE-2024-32480 LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system.High 7.2 · Apr 22, 2024
• CVE-2024-32479 LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system.High 7.1 · Apr 22, 2024
• CVE-2024-32461 LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system.High 7.1 · Apr 22, 2024
• CVE-2022-4070 Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.Critical 9.8 · Nov 20, 2022