NE
Vendor
netbox-community
9
CVEs
0
On KEV
2
New 30D
Products
DE9.6
devicetype-library
netbox-community
4 CVEs0 on KEV1 new
NE8.8
netbox
netbox-community
4 CVEs0 on KEV1 new
NE9.8
netbox-docker
netbox-community
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-104073 | NE netbox netbox-community | 7.6 | Oct 6 | NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links |
| CVE-2026-55251 | DE devicetype-library netbox-community | 6.5 | Oct 1 | NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files |
| CVE-2026-54918 | DE devicetype-library netbox-community | 5.3 | Sep 17 | NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI |
| CVE-2026-54916 | DE devicetype-library netbox-community | 8.8 | Sep 17 | NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft |
| CVE-2026-54752 | DE devicetype-library netbox-community | 9.6 | Sep 17 | NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request |
| CVE-2026-86176 | NE netbox netbox-community | 4.3 | Sep 5 | NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs |
| CVE-2026-86175 | NE netbox netbox-community | 6.5 | Sep 5 | NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs |
| CVE-2026-29514 | NE netbox netbox-community | 8.8 | May 4 | NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin |
| CVE-2023-27573 | NE netbox-docker netbox-community | 9.8 | Mar 11 | netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for… |