{"action":"Upgrade librenms/librenms to 26.2.0 or later.","affected":[{"fixed":"26.2.0","introduced":"0"}],"component":"librenms/librenms","cve_ids":["CVE-2026-26990"],"ecosystem":"Packagist","epss":0.04467,"exploited":false,"fixed_versions":["26.2.0"],"ghsa_id":"GHSA-79q9-wc6p-cf92","id":"tcs_01M5KEXX1A67QZ14DJ53DA8293","modified_at":"2026-02-22T23:22:17.703569Z","published_at":"2026-02-18T22:31:37Z","references":["https://osv.dev/vulnerability/GHSA-79q9-wc6p-cf92","https://github.com/librenms/librenms/security/advisories/GHSA-79q9-wc6p-cf92","https://github.com/librenms/librenms/pull/18777","https://github.com/librenms/librenms/commit/15429580baba03ed1dd377bada1bde4b7a1175a1","https://github.com/librenms/librenms"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-79q9-wc6p-cf92","url":"https://osv.dev/vulnerability/GHSA-79q9-wc6p-cf92"}],"summary":"LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php"}