CVE-2026-26987CWE-79

LibreNMS affected by reflected XSS via email field

Medium · published February 20, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00414 · 34.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-20T01:11Z
EPSS history
Timeline
  • 20 FEB 01:11Z
    LibreNMS affected by reflected XSS via email field
    cvelistv5