CVE-2026-84192

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

CVE-2026-84193

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

CVE-2026-84191

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary...

CVE-2026-84193

LibreNMS through version 26.2.0 is affected by a stored cross-site scripting (XSS) vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields , including BGP peer descriptions, VRF names, process information, and SLA tags. An attacker with device management access o...

CVE-2026-84193 LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

CVE-2026-84193 LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

CVE-2026-84193 LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

EUVD-2026-69030

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

CVE-2026-84192 LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

CVE-2026-84192 LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

CVE-2026-84192

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP interface descriptions and syslog program fields without proper escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript that executes when aut...

EUVD-2026-69029

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

CVE-2026-84192 LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

EUVD-2026-69028

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary...

CVE-2026-84191 LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary...

CVE-2026-84191 LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary...

CVE-2026-84191

LibreNMS versions prior to 26.5.0 contain stored cross-site scripting (XSS) vulnerabilities in VRF display pages. The root cause is that SNMP-polled fields—mplsVpnVrfDescription , vrf_name , and mplsVpnVrfRouteDistinguisher —are rendered without sanitization. An attacker controlling a monitored n...

CVE-2026-84191 LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary...

PT-2026-84156

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

CVE-2026-84192: Improper Neutralization of Input During Web Page Generation

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...