Vendor
Librenms vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 32 vulnerabilities in Librenms: 0 in the last 7 days and 23 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-109357, was published on 12 October 2026. 6 vulnerabilities in the last four weeks, up 500% on the four before (1). 1 technology has a page of its own.
- Last 7 days
- 0
- Last 90 days
- 23
- Critical, all time
- 2
- Exploited in the wild
- 0
About Librenms
Open-source network monitoring and management platform.
Librenms technologies
- Librenms32
Latest Librenms vulnerabilities
- CVE-2026-109357: LibreNMS LDAP filter injection in external authorization modeshighCVSS 8.1EPSS 0.5%
- CVE-2026-109356: LibreNMS missing authorization in PortsController::purgemediumCVSS 4.3EPSS 0.2%
- CVE-2026-109355: LibreNMS stored cross-site scripting in Oxidized node listmediumCVSS 6.1EPSS 0.2%
- CVE-2026-109354: LibreNMS path traversal in NFSen channel parametermediumCVSS 4.3EPSS 0.3%
- CVE-2026-109353: LibreNMS SQL injection in notifications.inc.phphighCVSS 7.1EPSS 0.3%
- CVE-2026-109352: LibreNMS stored cross-site scripting in wireless sensor descriptionmediumCVSS 6.1EPSS 0.2%
- CVE-2026-108715: LibreNMS authorization bypass in smokeping graph authmediumCVSS 4.3EPSS 0.3%
- CVE-2020-15875: LibreNMS SQL injection in ajax_table.phpmediumCVSS 5EPSS 0.3%
- CVE-2026-86427: LibreNMS argument injection in graph_title parameterhighCVSS 8.8EPSS 0.6%
- CVE-2026-86426: LibreNMS REST API authentication bypass via type coercioncriticalCVSS 9.8EPSS 3.9%
- CVE-2026-84194: LibreNMS OS command injection in libvirt discoveryinfoCVSS 8.6EPSS 1.5%
- CVE-2026-84193: LibreNMS stored cross-site scripting in SNMP datainfoCVSS 5.8EPSS 0.4%
- CVE-2026-84192: LibreNMS stored cross-site scripting in legacy PHP templateshighCVSS 7.1EPSS 0.3%
- CVE-2026-84191: LibreNMS stored XSS in VRF display pagesmediumCVSS 6.1EPSS 0.3%
- CVE-2026-84190: LibreNMS AboutController remote code execution in snmpget configurationhighCVSS 7.2EPSS 0.9%
- CVE-2026-84189: LibreNMS stored XSS in Oxidized integrationhighCVSS 8.1EPSS 0.4%
- CVE-2026-84188: LibreNMS stored cross-site scripting in graph description settingsmediumCVSS 4.8EPSS 0.3%
- CVE-2026-55182: LibreNMS remote code execution in Signal alert transporthighCVSS 4EPSS 1.6%
- CVE-2026-45694: LibreNMS reflected XSS in Proxmox application componentmediumCVSS 5.4EPSS 0.2%
- CVE-2020-15878: LibreNMS SQL injection in ajax_table.phphighCVSS 8.8EPSS 0.5%
- CVE-2020-15876: LibreNMS SQL injection in ajax_table.php sort parameterhighCVSS 8.8EPSS 0.3%
- CVE-2020-15874: LibreNMS command injection in graph.php APIhighCVSS 8.8EPSS 1.1%
- CVE-2026-80214: LibreNMS command injection in Virtualization Discovery moduleinfoCVSS 8.8EPSS 0.5%
- CVE-2024-51092: LibreNMS OS command injection in AboutController and SettingsControllercriticalCVSS 9.1EPSS 7.2%
- LibreNMS remote code execution in Binary Locations confighighCVSS 8.5
Most severe Librenms vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-86426: LibreNMS REST API authentication bypass via type coercioncriticalCVSS 9.8EPSS 3.9%
- CVE-2024-51092: LibreNMS OS command injection in AboutController and SettingsControllercriticalCVSS 9.1EPSS 7.2%
- CVE-2020-15874: LibreNMS command injection in graph.php APIhighCVSS 8.8EPSS 1.1%
- CVE-2026-86427: LibreNMS argument injection in graph_title parameterhighCVSS 8.8EPSS 0.6%
- CVE-2020-15878: LibreNMS SQL injection in ajax_table.phphighCVSS 8.8EPSS 0.5%
- CVE-2020-15876: LibreNMS SQL injection in ajax_table.php sort parameterhighCVSS 8.8EPSS 0.3%
- LibreNMS remote code execution in Binary Locations confighighCVSS 8.5
- CVE-2026-109357: LibreNMS LDAP filter injection in external authorization modeshighCVSS 8.1EPSS 0.5%
- CVE-2026-84189: LibreNMS stored XSS in Oxidized integrationhighCVSS 8.1EPSS 0.4%
- CVE-2026-6204: LibreNMS remote code execution in Binary Locations confighighCVSS 7.2EPSS 0.9%
Vulnerabilities per week
6 vulnerabilities in the last four weeks, up 500% on the four before (1). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 6 | 0 | |
| 31 Aug 2026 | 7 | 0 | |
| 7 Sep 2026 | 3 | 1 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 1 | 0 | |
| 12 Oct 2026 | 6 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Librenms vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/librenms)<a href="https://junglewise.ai/threats/vendors/librenms"><img src="https://junglewise.ai/threats/vendors/librenms/badge.svg" alt="Librenms vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/librenms.json, and this page as text at https://junglewise.ai/threats/vendors/librenms.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Librenms vulnerabilities", https://junglewise.ai/threats/vendors/librenms, 12 November 2026.