netbox v4.6.5

The cornerstone of every automated network NetBox Community | NetBox Cloud | NetBox Enterprise NetBox exists to empower network engineers. Since its release in 2016, it has become the go-to solution for modeling and documenting network infrastructure for thousands of organizations worldwide. As a...

PT-2026-62010

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description The safe-extract.py script extracts uploaded archives without imposing limits on the number of entries, directory depth, total entries, or output size. An attacker can use a small malicious archive...

PT-2026-62011

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description The safe-extract.py script fails to implement traversal protection when creating directory entries using the os.makedirsos.path.joindest, entry.pathname function. An attacker can upload a malicious...

PT-2026-62012

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description Role-based access control in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.request uri variable, whereas Nginx routes requests using the normalized path. An authenticated us...

aviary-genome (>=0.13.0, <=0.13.4), galaxy (>=26.0.0, <=26.0.1) +3 more potentially affected by CVE-2026-59890 via setuptools (80.10.1)

setuptools PYPI version 80.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - aviary-genome =0.13.0, =26.0.0, =20260123.0.0.dev3, =20260126.1.0.dev0 - netbox-manager 0.20260123.0 - water-column-sonar-processing 26.1....

containmint (0.6.0), netbox-manager (>=0.20250802.0, <=0.20260614.0) potentially affected by CVE-2026-11332 via ansible-core (>=2.19.0, <=2.19.3)

ansible-core PYPI version =2.19.0, =0.20250802.0, =0.20260614.0 Source cves: CVE-2026-11332 Source advisory: OSV:GHSA-W8P5-MX5W-CPQJ...

CVE-2026-29514

A flaw was found in NetBox. Authenticated users with exporttemplate or configtemplate permissions can exploit a vulnerability in the RenderTemplateMixin.getenvironmentparams method. By specifying malicious Python code in the environmentparams field, attackers can bypass security protections and...

Cross-site Scripting (XSS)

Overview netbox-data-flows is a NetBox plugin to document data flows between systems and applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ObjectAlias.name field rendered in DataFlow tables. An attacker can execute arbitrary JavaScript in the brows...

PT-2026-41609

Summary An authenticated user who can create or edit ObjectAlias objects can store arbitrary HTML/JavaScript in an alias name. That payload is later rendered unescaped in DataFlow table views, causing a stored XSS when another user views the affected page. Details The issue is caused by unsafe HT...

CVE-2026-29514

NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.getenvironmentparams method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the...

CVE-2026-29514

CVE-2026-29514 affects NetBox versions 4.3.5 through 4.5.4, with a remote code execution flaw in the RenderTemplateMixin.get_environment_params() method. Authenticated users with exporttemplate or configtemplate permissions can supply malicious Python callables in the environment_params field, de...

EUVD-2026-26997

NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.getenvironmentparams method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the...

CVE-2026-29514 NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin

NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.getenvironmentparams method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the...

CVE-2026-29514 NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin

NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.getenvironmentparams method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the...

CVE-2026-29514

NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.getenvironmentparams method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the...

CVE-2026-29514 NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin

NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.getenvironmentparams method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the...

NetBox 安全漏洞

NetBox is a tool developed by the NetBox community, based on Django and PostgreSQL, for IP address management IPAM and data center infrastructure management DCIM. There were security vulnerabilities in versions 4.3.5 to 4.5.4 of NetBox. These vulnerabilities stemmed from remote code execution in...

PT-2026-36830

Name of the Vulnerable Software and Affected Versions NetBox versions 4.3.5 through 4.5.4 Description An issue in the RenderTemplateMixin.get environment params method allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code. By specifying malicious...

CVE-2026-29514: Permissive List of Allowed Inputs

NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.getenvironmentparams method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifying malicious Python callables in the...

CVE-2025-57543

Cross Site scripting vulnerability XSS in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the web UI when viewed by other users. This could potentially lead to user interface redress attacks or be escalated to XSS in certain contexts...