{"action":"Upgrade librenms/librenms to 26.3.0 or later.","affected":[{"fixed":"26.3.0","introduced":"25.12.0"}],"component":"librenms/librenms","cve_ids":["CVE-2026-2728"],"ecosystem":"Packagist","epss":0.00225,"exploited":false,"fixed_versions":["26.3.0"],"ghsa_id":"GHSA-5gm9-622f-qcg5","id":"tcs_01M5KEW1XNNSZ990K6P9HJRGPQ","modified_at":"2026-05-18T17:26:25.609485Z","published_at":"2026-05-18T17:00:49Z","references":["https://osv.dev/vulnerability/GHSA-5gm9-622f-qcg5","https://github.com/librenms/librenms/security/advisories/GHSA-5gm9-622f-qcg5","https://github.com/librenms/librenms","https://github.com/librenms/librenms/releases/tag/26.3.0"],"severity":{"label":"low","score":3.5},"sources":[{"source":"osv","source_id":"GHSA-5gm9-622f-qcg5","url":"https://osv.dev/vulnerability/GHSA-5gm9-622f-qcg5"}],"summary":"LibreNMS: Cross-Site Scripting in ShowConfigController"}