CVE-2026-109356Medium· 4.3▾ SunlitLibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE request…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase every deleted port on all visible devices.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109357High· 8.1LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence
CVE-2026-109354Medium· 4.3LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter
CVE-2026-109355Medium· 6.1LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped
CVE-2026-109352Medium· 6.1LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into…
CVE-2026-109353High· 7.1LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php
CVE-2026-108715Medium· 4.3LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device