geonetwork

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

geonetwork records in CISA KEV

No geonetwork vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Opensource 1 record LOW

Records

9 records

TI-2026-45097 CVE-2026-63219

Unauthenticated file upload via missing authorization on formatter upload endpoint

MEDIUM 44

GeoNetwork is a catalog application to manage spatially referenced resources.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00466 Published 2026-09-03 Fixed in 4.4.12, 4.2.17 CWE-862

TI-2026-42016 CVE-2026-58400

GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

MEDIUM 44

GeoNetwork is a catalog application to manage spatially referenced resources.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01187 Published 2026-09-03 Fixed in 4.4.12, 4.2.17 CWE-470

TI-2022-26353 CVE-2022-50899 · GHSA-q595-r7rh-mc9h

Geonetwork 4.2.0 - XML External Entity (XXE)

MEDIUM 44

Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00551 Published 2026-01-13 No fix listed CWE-611

TI-2026-40323 CVE-2026-55864 · GHSA-5hx7-j24v-rffj

GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

MEDIUM 43

GeoNetwork is a catalog application to manage spatially referenced resources.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.01446 Published 2026-09-15 Fixed in 4.2.17, 4.4.12 CWE-918

TI-2026-84467 CVE-2026-46487

Access control bypass in GeoNetwork Elasticsearch search proxy

LOW 39

GeoNetwork is a catalog application to manage spatially referenced resources.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00463 Published 2026-11-03 Fixed in 4.2.16, 4.4.11 CWE-862

TI-2006-05324 CVE-2006-5513 · GHSA-c5c5-98w5-w383

SQL injection vulnerability in GeoNetwork opensource before 2.0.3 allows remote attackers…

LOW 35

SQL injection vulnerability in GeoNetwork opensource before 2.0.3 allows remote attackers to execute arbitrary SQL commands, and complete a login, via unspecified vectors.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01192 Published 2006-10-26 No fix listed

TI-2026-84477 CVE-2026-39379

Reflected XSS in GeoNetwork through AngularJS template injection

LOW 31

GeoNetwork is a catalog application to manage spatially referenced resources.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00357 Published 2026-11-03 Fixed in 4.2.15, 4.4.10 CWE-1336

TI-2024-21128 CVE-2024-32037 · GHSA-52rf-25hq-5m33

GeoNetwork vulnerable to search end-point information disclosure in response headers

LOW 30

GeoNetwork is a catalog application to manage spatially referenced resources.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00377 Published 2025-02-11 Fixed in 4.2.10, 4.4.5 CWE-200

TI-2026-38636 CVE-2026-53573 · GHSA-pjp7-q6wp-97qx

core-geonetwork has an Open Redirect Bypass

LOW 23

GeoNetwork is a catalog application to manage spatially referenced resources.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00648 Published 2026-07-31 Fixed in 4.2.16, 4.4.11 CWE-601

Open these records in search →

Critical	1
High	6
Medium	2
Low	0
No CVSS	0