Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in version 26.2.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27016 Stored XSS in LibreNMS Custom OID Parameter Affecting Versions 24.10.0-26.1.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27016
Post summary
The CVE‑2026‑27016 entry describes a stored XSS vulnerability in LibreNMS’s Custom OID Parameter affecting versions 24.10.0 to 26.1.1; no proof‑of‑concept, exploit code, active exploitation, patch, or debunking claim is provided.
CVE-2026-27016 LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in C… https://www.cve.org/CVERecord?id=CVE-2026-27016
Post summary
CVE-2026-27016 affects LibreNMS v24.10.0 through v26.1.1, introducing a stored XSS via the unit parameter; no exploit, patch, or PoC is referenced.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | librenms | librenms | - | - | - |