netbox

The cornerstone of every automated network NetBox Community | NetBox Cloud | NetBox Enterprise...

Netbox-CVE-2023-37625

Netbox-CVE-2023-37625 Description A stored cross-site scripting XSS vulnerability in Netbox alert1' 3. Add a new model, in this example add a 'manufacturer' model. 4. Open the newly created model as any authenticated user, and observer that the alert box has executed...

CVE-2024-23780

CVE-2024-23780 Exploit for Netbox This script exploits CVE-2024-23780, which allows remote code execution RCE on Netbox instances. Usage python netboxexploit.py --url --username --password Parameters --url: URL of the Netbox instance. --username: Username for authentication with the Netbox...

CVE-2025-69848-security-advisories

Reflected XSS in NetBox ProtectedError Handling CVE-2025-69848 Overview NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting XSS vulnerability exists in the ProtectedError exception handling logic. When a delete operation...

CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

EUVD-2026-71975

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86176

NetBox through 4.7.0 fails to properly scope user-private records in its REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks . The root cause is the use of unscoped querysets , which allows any authenticated user with view permissions to access all users' private record...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses . Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, enabling unauthorized access to e...

EUVD-2026-71974

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-73229 vulnerabilities

Vulnerabilities for packages: authentik-fips, netbox, netbox-fips, authentik, awx...

GHSA-2M8G-3CMR-WG3W vulnerabilities

Vulnerabilities for packages: authentik-fips, netbox, netbox-fips, authentik, awx...

CVE-2026-73228 vulnerabilities

Vulnerabilities for packages: authentik-fips, netbox, netbox-fips, authentik, awx...

GHSA-G47C-3XMW-Q6M2 vulnerabilities

Vulnerabilities for packages: authentik-fips, netbox, netbox-fips, authentik, awx...

CVE-2026-54284 vulnerabilities

Vulnerabilities for packages: superset, openstack-horizon-2025.2, mycli, mlflow, openstack-glance-2026.1, openstack-glance-2026.1-fips, openstack-nova-2025.1, openstack-keystone-2025.2, netbox, openstack-nova-2025.2, authentik-fips, openstack-placement-2026.1, openstack-keystone-2026.1-fips,...

CVE-2026-59893 vulnerabilities

Vulnerabilities for packages: superset, openstack-horizon-2025.2, mycli, mlflow, openstack-glance-2026.1, openstack-glance-2026.1-fips, openstack-nova-2025.1, openstack-keystone-2025.2, netbox, openstack-nova-2025.2, authentik-fips, openstack-placement-2026.1, openstack-keystone-2026.1-fips,...

GHSA-PWGV-4X5Q-6M9F vulnerabilities

Vulnerabilities for packages: superset, openstack-horizon-2025.2, mycli, mlflow, openstack-glance-2026.1, openstack-glance-2026.1-fips, openstack-nova-2025.1, openstack-keystone-2025.2, netbox, openstack-nova-2025.2, authentik-fips, openstack-placement-2026.1, openstack-keystone-2026.1-fips,...