https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T06:29:07.958133+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0174 certfr-2026-avi-0174 — De multiples vulnérabilités ont été découvertes dans LibreNMS. Elles permettent à un attaquant de provoquer une injecti… 2026-10-18T06:29:07.960857+00:00 certfr-2026-avi-0174 https://cve.radiocsirt.org/vuln/euvd-2026-268922 EUVD-2026-268922 2026-10-18T06:29:07.960892+00:00 EUVD-2026-268922 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26987 fkie_cve-2026-26987 2026-10-18T06:29:07.960907+00:00

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0.

 https://cve.radiocsirt.org/vuln/ghsa-gqx7-99jw-6fpr GHSA-gqx7-99jw-6fpr — LibreNMS affected by reflected xss via email field 2026-10-18T06:29:07.960933+00:00

Affected: Packagist: librenms/librenms

### Summary reflected xss via email field

### Details 1. visit `http://127.0.0.1/settings/alerting/email` 2. in the email address input but this payload `<img src=1 onerror=alert(document.cookie)>` 3. notice the alert ### PoC - video attached with the report https://github.com/user-attachments/assets/c1b443f5-85c6-4545-b04f-def06d82b42e

### Impact can lead to ATO