Netbox
57 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Netbox, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.
Netbox CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 4 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 1 |
| 2026-09 | 2 |
Severity
How the 57 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical4
- High3
- Medium49
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Netbox.
- CVE-2026-86176NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs4.3
- CVE-2026-86175NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs6.5
- CVE-2026-69117NetBox 4.5.8 ORM Injection via WritableNestedSerializer6.5
- CVE-2026-29514NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin8.8
- CVE-2025-57543Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms. An attacker can inject arbitrary HTML, which will be rendered in the web UI when viewed by other users. Thi...6.1
- CVE-2025-69848NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting (XSS) vulnerability exists in versions 2.11.0 through 3.7.x in the Pro...5.4
- CVE-2024-56915Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget.6.5
- CVE-2024-56917Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance mode.7.1
- CVE-2024-56916In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticate...6.1
- CVE-2024-56918In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user input from the login form.6.1
- CVE-2024-47226A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated u...5.4
- CVE-2024-40740A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-feeds/{id...6.1
- CVE-2024-40739A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-feeds/add.6.1
- CVE-2024-40736A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/add.6.1
- CVE-2024-40734A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/front-ports/add/.6.1
Product grouping is registry-driven, with AI assist and human review. How it works