PULSE
ES
FEED
ransomhyflock reclama a Aesthetic Dental Designs, P.A · US · Healthcareransomqilin reclama a ECOM · CH · Retail & E-Commerceransomemperador reclama a AyT COMPUTERS SRL · Technologyransomqilin reclama a ETO · DE · Not Foundransomn0n reclama a TOPLIVO AD · BG · Energy & Utilitiesransomn0n reclama a Technoleads Services Inc. · Technologyransomn0n reclama a Pure Grow Diamonds Inc. · Manufacturingransomn0n reclama a Mach Law APC (San Diego family law and divorce practice) · US · Professional Servicesransomn0n reclama a Keidel Supply Company Incorporated · US · Manufacturingransomn0n reclama a Andrews Advisory Group LLC · US · Professional Servicesransomemperador reclama a AB InBev · BE · Agriculture and Food Productionransomwhitearmor reclama a Hisense · CN · Technologyransomanubis reclama a Newcomer Cremations, Funerals & Receptions · US · Healthcareransomqilin reclama a Castle Howard Estate · GB · Hospitalityransomhyflock reclama a Aesthetic Dental Designs, P.A · US · Healthcareransomqilin reclama a ECOM · CH · Retail & E-Commerceransomemperador reclama a AyT COMPUTERS SRL · Technologyransomqilin reclama a ETO · DE · Not Foundransomn0n reclama a TOPLIVO AD · BG · Energy & Utilitiesransomn0n reclama a Technoleads Services Inc. · Technologyransomn0n reclama a Pure Grow Diamonds Inc. · Manufacturingransomn0n reclama a Mach Law APC (San Diego family law and divorce practice) · US · Professional Servicesransomn0n reclama a Keidel Supply Company Incorporated · US · Manufacturingransomn0n reclama a Andrews Advisory Group LLC · US · Professional Servicesransomemperador reclama a AB InBev · BE · Agriculture and Food Productionransomwhitearmor reclama a Hisense · CN · Technologyransomanubis reclama a Newcomer Cremations, Funerals & Receptions · US · Healthcareransomqilin reclama a Castle Howard Estate · GB · Hospitality
← All CVEs
CVE WatchOct 5, 2026

CVE-2026-55251

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the

CVSS

6.5

Medium

EPSS

0.1%

p2

KEV

—

Exploit Today

1

0-100

Published: Oct 1, 2026 · Last modified: Oct 5, 2026 · CWE-94 · CWE-494 · CWE-829

EPSS · 30d
0.1%EPSS · 30 days0.1%
2026-10-022026-10-25
Technical description

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pull_request and executes code supplied by the pull request before any maintainer review. Three PR-editable files drive this: "requirements.txt", ".pre-commit-hooks-config.yaml" / ".pre-commit-yamlfmt-config.yaml", and ".gitmodules". A contributor with no special repository access could open a pull request that modifies these files and have their code run on the CI runner. This issue has been patched via commit f41fc1e.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1160474.3 MED
18.0%
——5A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the argument welcome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.9hCVE-2026-1160043.5 LOW
9.6%
——3A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.14hCVE-2026-1159824.3 MED
18.9%
——6A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.19hCVE-2026-1159812.4 LOW
16.6%
——5A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.19hCVE-2026-1159707.3 HIG
23.0%
——7A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.23hCVE-2026-1158024.3 MED
21.1%
——6A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.1d