Domain
Network monitoring and threat intelligence platforms.
3 write-ups, 3 vulnerabilities
CVE-2026-84191
6.1 · MediumLibreNMS rendered VRF names, descriptions and route distinguishers polled over SNMP without escaping, so a rogue device could run script in an operator’s browser.
CVE-2026-35211
6.5 · MediumAny OpenCTI user with the KNOWLEDGE capability could send raw Painless scripts to Elasticsearch through a public filter operator and exhaust the cluster.
pfSense-SA-26_03.webgui
Highlighted 5.2 · MediumA DHCP client on the local network could store a hostname carrying JavaScript that ran in a pfSense administrator’s browser when they opened the ARP table.
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-84191 | LibreNMS | Stored XSS in VRF pages from SNMP data | 6.1 Medium | |
| CVE-2026-35211 | OpenCTI | Painless script injection through the script filter operator | 6.5 Medium | |
| pfSense-SA-26_03.webgui | Netgate pfSense | Stored XSS in diag_arp.php via an ISC DHCP hostname | 5.2 Medium |
