netbox vulnerabilities and fixes

Recent CVEs affecting netbox, with upgrade or downgrade steps. 25 tracked.

netbox has 25 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-03-16. Highest priority: CVE-2024-56917 (score 38/100).

• CVE-2025-69848 MEDIUM 5.4 UPGRADE NetBox is an open-source infrastructure resource modeling and IP address management platform
• CVE-2025-57543 MEDIUM 6.1 DOWNGRADE Cross Site scripting vulnerability (XSS) in NetBox 4.3.5 "comment" field on object forms
• CVE-2024-56918 MEDIUM 6.1 UPGRADE In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileg
• CVE-2024-56917 HIGH 7.1 UPGRADE Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance
• CVE-2024-56916 MEDIUM 6.1 UPGRADE In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripti
• CVE-2024-56915 MEDIUM 6.5 UPGRADE Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widg
• CVE-2024-47226 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" fe
• CVE-2024-40742 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40741 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40740 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40739 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40738 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40737 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40736 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40735 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40734 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40733 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40732 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40731 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40730 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40729 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40728 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40727 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-40726 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts
• CVE-2024-38972 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts

FAQ

How do I fix netbox vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is netbox being exploited right now?

None of the tracked netbox CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which netbox CVE should I patch first?

CVE-2024-56917 currently ranks highest (38/100): Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance .

RSS feed for netbox · ← Back to latest CVEs