netbox vulnerabilities

2 known vulnerabilities in netbox from Netbox-community. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.6 High severity

  netbox: Improper Neutralization of Input During Web Page Generation

  CVE-2026-104073Oct 6, 2026Netbox-community

  NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest

• 8.8 High severity

  netbox: Permissive List of Allowed Inputs

  CVE-2026-29514May 4, 2026Netbox-community

  NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or configtemplate permissions to execute arbitrary code by specifyi