CVE-2026-109355

LibreNMS versions before 26.9.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the get_oxidized_nodes_list() function. The root cause is the rendering of Oxidized API fields and SNMP sysName without proper escaping. An attacker who can control the Oxidized response or ...