N
Vendor security profile
netbox-community
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical1
CISA KEV0
Public exploit3
Patch rate%14
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
5
2
CVE KEV
CVE severity distribution
7toplam CVE
Critical1 (14%)
High1 (14%)
Medium5 (71%)
Patch and exploitation view
%14
Verified patch
%0
CISA KEV
%43
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
6Unknown
Latest vulnerabilities
6.9
CVE-2026-104073
NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
N
Patch verifiedEPSS %0
6.5
CVE-2026-55251
NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files
N
Patch status unknownEPSS %0
5.3
CVE-2026-54918
NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI
N
Patch status unknownEPSS %0
8.8
CVE-2026-54916
NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft
N
Patch status unknownEPSS %1
9.6
CVE-2026-54752
NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request
N
Patch status unknownEPSS %1
4.3
CVE-2026-86176
NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs
N
Patch status unknownEPSS %0
6.5
CVE-2026-86175
NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
N
Patch status unknownEPSS %0