CVE-2026-84189 LibreNMS before 26.7.0 Stored XSS via Oxidized API

LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...

CVE-2026-84189

LibreNMS through 26.4.0 is affected by a stored XSS in the Oxidized integration . JSON fields (name , ip , model , author , commit message ) returned by the admin-configurable oxidized.url are rendered into the device showconfig page without htmlspecialchars(). An administrator who points the Oxi...