Loading story…
A high-severity stored cross-site scripting vulnerability, GHSA-7w8c-qgxg-m7jx (CWE-79), affects LibreNMS legacy PHP templates that render monitoring data without consistent output encoding. Attackers able to control SNMP metadata, spoof Syslog messages, or supply crafted BGP descriptions can store JavaScript payloads that execute when administrators view device-health, routing, or event-log pages, potentially compromising administrator browser sessions and enabling session takeover.
Organizations should update LibreNMS and related packages to version 26.5.0 or later; Tenable Cloud Security plugin 446367 can identify affected librenms/librenms deployments. Developers should apply contextual output encoding, including Laravel's e() helper or escaped Blade {{ ... }} syntax rather than raw output, and deploy a restrictive Content Security Policy as defense in depth. No known exploitation has been reported.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Tenable published and updated Cloud Security SCA plugin 446367 to detect affected librenms/librenms installations associated with GHSA-7w8c-qgxg-m7jx.
GHSA-7w8c-qgxg-m7jx, a high-severity stored cross-site scripting vulnerability in LibreNMS legacy templates handling SNMP and Syslog data, was published. Updating LibreNMS and related packages to version 26.5.0 or later remediates the issue; the referenced information reported no known exploits.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcetenable.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A blind SQL injection vulnerability tracked as **`CVE-2020-15873`** affects **LibreNMS 1.64.1**, allowing an authenticated attacker to extract arbitrary information from the monitoring platform’s database. The flaw stems from insufficient input sanitization in `customoid.inc.php`, where the `device_id` POST parameter sent to `ajax_form.php` can be manipulated to inject SQL statements. Researchers reported that the issue can be exploited as a time-based blind SQL injection, using delayed responses to infer data such as database version details and potentially recover the full contents of the LibreNMS database. LibreNMS is an open-source, community-maintained network monitoring system hosted on GitHub, and the recommended mitigation is to remediate the vulnerable code path by using **parameterized queries**.
Aug 15, 2026
A stored DOM-based cross-site scripting flaw tracked as **`CVE-2026-65592`** affects the n8n workflow automation platform, allowing authenticated users with workflow creation or editing rights to plant a malicious URI in the Resource Locator component's **`cachedResultUrl`** field. The value is saved in workflow metadata and later passed to **`window.open()`** without validating the URL scheme, so a victim who opens the crafted workflow and clicks the external resource link can trigger attacker-controlled JavaScript in their browser. The vulnerability affects n8n versions before **`1.123.64`**, before **`2.29.8`**, and before **`2.30.1`**. Reports say the bug could enable session hijacking or abuse of n8n API access available to the victim user, and classify the issue as **CWE-79** with network attackability, low attack complexity, low privileges required, and user interaction required. Recommended remediation is to upgrade to a fixed release and enforce strict scheme validation so only safe **`http`** and **`https`** URLs are accepted in **`cachedResultUrl`**.
Jul 23, 2026
Checkmk disclosed two stored cross-site scripting vulnerabilities affecting **Checkmk 2.5.0 beta releases before `2.5.0b2`**. The issues, tracked as **`CVE-2026-33276`** and **`CVE-2026-20915`**, allow authenticated users to inject malicious JavaScript that later executes in other users’ browsers. Both flaws are classified as **`CWE-79`** and are remotely exploitable with low attack complexity, though successful exploitation requires user interaction. The first bug, **`CVE-2026-33276`**, affects the **Unified Search** feature and stems from unescaped host or service names, enabling users with permission to create hosts or services to plant persistent script payloads. The second, **`CVE-2026-20915`**, affects the **Pending Changes** sidebar and allows users with permission to create pending changes to inject stored JavaScript viewed by other users. Checkmk published vendor advisories for the flaws as **Werk `19525`** and **Werk `19526`**, and both issues were reported to `security@checkmk.com`.
Jun 29, 2026