nautobot vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-44798Highnautobot: Nautobot: GitRepository.current_head field should not be writable through REST API CVE-2026-44797Highnautobot: Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)CVE-2026-44796Mediumnautobot: Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular…CVE-2026-44794Mediumnautobot: Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should…CVE-2026-34203Lownautobot: Nautobot: Management of users via REST API does not apply configured password validators CVE-2025-49143Mediumnautobot: Nautobot may allows uploaded media files to be accessible without authentication CVE-2025-49142Mediumnautobot: Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating CVE-2024-36112Mediumnautobot: Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects CVE-2024-34707Highnautobot: Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages CVE-2024-32979Highnautobot: nautobot has reflected Cross-site Scripting potential in all object list views CVE-2024-29199Lownautobot: Unauthenticated views may expose information to anonymous users CVE-2024-23345Highnautobot: XSS potential in rendered Markdown fields (comments, description, notes, etc.)CVE-2023-51649Lownautobot: Nautobot missing object-level permissions enforcement when running Job Buttons CVE-2023-50263Lownautobot: Unauthenticated db-file-storage views CVE-2023-48705Highnautobot: Cross-site Scripting potential in custom links, job buttons, and computed fields CVE-2023-46128Highnautobot: Nautobot vulnerable to exposure of hashed user passwords via REST API CVE-2023-25657Highnautobot: Nautobot vulnerable to remote code execution via Jinja2 template rendering

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo