CVE-2026-109353 [HIGH] – LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged us

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface.