TI-2026-29863 CVE-2026-41255 · GHSA-mcvf-jxcw-vj73
CKAN: CSRF exemption primed by anonymous requests
Priority MEDIUM 60
CKAN is an open-source DMS (data management system) for powering data hubs and data portals.
ckan
Records17All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
ckan records in CISA KEVNo ckan vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
17 records
TI-2021-07973 CVE-2021-25967 · GHSA-6w9p-88qg-p3g3
CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload
Priority MEDIUM 58
In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture.
TI-2023-15615 CVE-2023-32321 · GHSA-446m-hmmm-hm8m
CKAN remote code execution and private information access via crafted resource ids
Priority MEDIUM 52
CKAN is an open-source data management system for powering data hubs and data portals.
TI-2026-30410 CVE-2026-42031 · GHSA-h7j7-3rx6-xvcg
CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
Priority MEDIUM 48
CKAN is an open-source DMS (data management system) for powering data hubs and data portals.
TI-2023-08919 CVE-2023-22746
CKAN is vulnerable to session secret shared across instances using Docker images
Priority MEDIUM 44
CKAN is an open-source DMS (data management system) for powering data hubs and data portals.
TI-2023-15972 CVE-2023-32696
Excessive permissions for ckan user
Priority MEDIUM 41
CKAN is an open-source data management system for powering data hubs and data portals.
TI-2022-21443 CVE-2022-43685 · GHSA-m2xp-jxfg-qq6g
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is…
Priority MEDIUM 41
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request.
TI-2026-29760 CVE-2026-41132 · GHSA-mpfm-fpgx-647q
CKAN: No certificate validation on STMP connection
Priority LOW 37
CKAN is an open-source DMS (data management system) for powering data hubs and data portals.
TI-2026-30411 CVE-2026-42032 · GHSA-cg4x-64p3-x59h
CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`
Priority LOW 36
CKAN is an open-source DMS (data management system) for powering data hubs and data portals.
TI-2025-18115 CVE-2025-24372 · GHSA-7pq5-qcp6-mcww
XSS vector in user uploaded images in group/org and user profiles in ckan
Priority LOW 32
CKAN is an open-source DMS (data management system) for powering data hubs and data portals.
TI-2024-27736 CVE-2024-41675 · GHSA-r3jc-vhf4-6v32
CKAN has a Cross-site Scripting vector in the Datatables view plugin
Priority LOW 30
CKAN is an open-source data management system for powering data hubs and data portals.
TI-2024-27735 CVE-2024-41674 · GHSA-2rqw-cfhc-35fh
CKAN may leak Solr credentials via error message in package_search action
Priority LOW 30
CKAN is an open-source data management system for powering data hubs and data portals.
TI-2023-27476 CVE-2023-50248 · GHSA-7fgc-89cx-w8j5
CKAN out of memory error when submitting the dataset form with a specially-crafted field
Priority LOW 30
CKAN is an open-source data management system for powering data hubs and data portals.
TI-2024-29022 CVE-2024-43371 · GHSA-g9ph-j5vj-f8wm
Potential access to sensitive URLs via CKAN extensions (SSRF)
Priority LOW 29
CKAN is an open-source data management system for powering data hubs and data portals.
TI-2025-39551 CVE-2025-64100 · GHSA-2hvh-cw5c-8q8q
CKAN Vulnerable to Session Cookie Fixation
Priority LOW 27
CKAN is an open-source DMS (data management system) for powering data hubs and data portals.
TI-2025-34192 CVE-2025-54384 · GHSA-2r4h-8jxv-w2j8
CKAN stored XSS vulnerability in Markdown description fields
Priority LOW 27
CKAN is an open-source DMS (data management system) for powering data hubs and data portals.
TI-2024-17958 CVE-2024-27097 · GHSA-8g38-3m6v-232j
Potential log injection in reset user endpoint in ckan
Priority LOW 24
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log.