Is CVE-2026-109355 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109355?

CVE-2026-109355 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-109355

Description

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the Tools Oxidized page.