CVE-2026-27016

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit parameter in Custom OID. The Custom OID functionality lacks strip_tags() sanitization while other fields (name, oid, datatype) are sanitized. The unsanitized value is stored in the database and rendered without HTML escaping. This issue is fixed in version 26.2.0.

• CWE-79
• CWE-116
• CWE-79

• https://github.com/librenms/librenms/commit/3bea263e02441690c01dea7fa3fe6ffec94af335Patch
• https://github.com/librenms/librenms/pull/19040Issue Tracking
• https://github.com/librenms/librenms/releases/tag/26.2.0Product, Release Notes
• https://github.com/librenms/librenms/security/advisories/GHSA-fqx6-693c-f55gThird Party Advisory

Published

Feb 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27009OpenClaw is a personal AI assistant. Prior to version 2026.2…5.8
• CVE-2026-2701Authenticated user can upload a malicious file to the server…8.8
• CVE-2026-27012OpenSTAManager is an open source management software for tec…9.8
• CVE-2026-27013Fabric.js is a Javascript HTML5 canvas library. Prior to ver…6.1
• CVE-2026-27014NanaZip is an open source file archive Starting in version 5…5.5
• CVE-2026-27015FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-27017uTLS is a fork of crypto/tls, created to customize ClientHel…5.3
• CVE-2026-27018Gotenberg is an API for converting document formats. Prior t…7.5
• CVE-2026-2702A security flaw has been discovered in Beetel 777VR1 up to 0…3.1
• CVE-2026-27020Photobooth prior to 1.0.1 has a cross-site scripting (XSS) v…5.3
• CVE-2026-27021Discourse is an open source discussion platform. Prior to ve…5.3
• CVE-2026-27022@langchain/langgraph-checkpoint-redis is the Redis checkpoin…6.5