Technology · Packagist
librenms/librenms (Packagist) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 107 vulnerabilities in librenms/librenms (Packagist): 0 in the last 7 days and 6 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-84192, was published on 1 September 2026. Nothing was published in the last eight weeks.
- Last 7 days
- 0
- Last 90 days
- 6
- Critical, all time
- 1
- Exploited in the wild
- 0
About librenms/librenms (Packagist)
Open-source network monitoring and management platform.
Latest librenms/librenms (Packagist) vulnerabilities
- CVE-2026-84192: LibreNMS stored cross-site scripting in legacy PHP templateshighCVSS 7.1EPSS 0.3%
- CVE-2026-84190: LibreNMS AboutController remote code execution in snmpget configurationhighCVSS 7.2EPSS 0.9%
- CVE-2026-84189: LibreNMS stored XSS in Oxidized integrationhighCVSS 8.1EPSS 0.4%
- CVE-2026-84188: LibreNMS stored cross-site scripting in graph description settingsmediumCVSS 4.8EPSS 0.3%
- CVE-2026-55182: LibreNMS remote code execution in Signal alert transporthighCVSS 4EPSS 1.6%
- CVE-2026-45694: LibreNMS reflected XSS in Proxmox application componentmediumCVSS 5.4EPSS 0.2%
- CVE-2024-51092: LibreNMS OS command injection in AboutController and SettingsControllercriticalCVSS 9.1EPSS 7.2%
- LibreNMS remote code execution in Binary Locations confighighCVSS 8.5
- CVE-2026-6204: LibreNMS remote code execution in Binary Locations confighighCVSS 7.2EPSS 0.9%
- CVE-2026-2728: LibreNMS authenticated XSS in showconfig pagemediumCVSS 4.8EPSS 0.3%
- CVE-2026-26990: LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.phplowCVSS 3.1EPSS 0.6%
- CVE-2026-26989: LibreNMS has a Stored XSS in Alert RulelowCVSS 3.1EPSS 0.3%
- CVE-2026-26988: LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream.infoEPSS 0.5%
- CVE-2026-27016: LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags()lowCVSS 3.1EPSS 0.3%
- CVE-2026-26992: LibreNMS /port-groups name Stored Cross-Site ScriptingmediumCVSS 4EPSS 0.3%
- CVE-2026-26991: LibreNMS /device-groups name Stored Cross-Site ScriptingmediumCVSS 4EPSS 0.3%
- CVE-2026-26987: LibreNMS affected by reflected xss via email fieldmediumCVSS 4EPSS 0.4%
- CVE-2020-36947: LibreNMS contains an authenticated SQL Injection vulnerabilityhighCVSS 7.1EPSS 0.5%
- CVE-2025-68614: LibreNMS Alert Rule API Cross-Site Scripting VulnerabilitymediumCVSS 4.3EPSS 3.9%
- CVE-2025-65093: LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpointmediumCVSS 5.5EPSS 3.7%
- CVE-2025-65014: LibreNMS has Weak Password PolicylowCVSS 3.7EPSS 0.3%
- CVE-2025-65013: LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`mediumCVSS 6.2EPSS 0.3%
- CVE-2025-62412: LibreNMS alert-rules has a Cross-Site Scripting VulnerabilitylowCVSS 3.1EPSS 0.3%
- CVE-2025-62411: LibreNMS has a Stored XSS vulnerability in its Alert Transport name fieldlowCVSS 3.1EPSS 12.7%
- CVE-2025-62365: LibreNMS is vulnerable to Reflected-XSS in `report_this` functionmediumCVSS 4EPSS 0.3%
Most severe librenms/librenms (Packagist) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2024-51092: LibreNMS OS command injection in AboutController and SettingsControllercriticalCVSS 9.1EPSS 7.2%
- LibreNMS remote code execution in Binary Locations confighighCVSS 8.5
- CVE-2026-84189: LibreNMS stored XSS in Oxidized integrationhighCVSS 8.1EPSS 0.4%
- CVE-2026-6204: LibreNMS remote code execution in Binary Locations confighighCVSS 7.2EPSS 0.9%
- CVE-2026-84190: LibreNMS AboutController remote code execution in snmpget configurationhighCVSS 7.2EPSS 0.9%
- CVE-2020-36947: LibreNMS contains an authenticated SQL Injection vulnerabilityhighCVSS 7.1EPSS 0.5%
- CVE-2026-84192: LibreNMS stored cross-site scripting in legacy PHP templateshighCVSS 7.1EPSS 0.3%
- CVE-2026-55182: LibreNMS remote code execution in Signal alert transporthighCVSS 4EPSS 1.6%
- CVE-2025-65013: LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`mediumCVSS 6.2EPSS 0.3%
- CVE-2025-65093: LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpointmediumCVSS 5.5EPSS 3.7%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 2 | 0 | |
| 31 Aug 2026 | 4 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many librenms/librenms (Packagist) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/librenms-librenms)<a href="https://junglewise.ai/threats/technologies/librenms-librenms"><img src="https://junglewise.ai/threats/technologies/librenms-librenms/badge.svg" alt="librenms/librenms (Packagist) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/librenms-librenms.json, and this page as text at https://junglewise.ai/threats/technologies/librenms-librenms.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "librenms/librenms (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/librenms-librenms, 9 November 2026.