Vulnerabilities

TI-2026-32678 CVE-2026-44794 · GHSA-wpxj-44w3-2j6x

Missing authorization in nautobot

LOW 24

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00177 Published 2026-05-28 Fixed in 3.1.2, 2.4.33 CWE-862

TI-2026-32680 CVE-2026-44796 · GHSA-qrpw-gjvh-x5gm

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

LOW 29

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00312 Published 2026-05-28 Fixed in 3.1.2, 2.4.33 CWE-1333

TI-2026-32681 CVE-2026-44797 · GHSA-c35q-vxrp-ph26

Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

LOW 36

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00235 Published 2026-05-28 Fixed in 3.1.2, 2.4.33 CWE-918

TI-2026-32682 CVE-2026-44798 · GHSA-p3hx-pwf3-j8wr

Nautobot: GitRepository.current_head field should not be writable through REST API

LOW 31

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00277 Published 2026-05-28 Fixed in 3.1.2, 2.4.33 CWE-471

TI-2026-26498 CVE-2026-34203 · GHSA-xmpv-j7p2-j873

Nautobot: Management of users via REST API does not apply configured password validators

LOW 20

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00255 Published 2026-03-31 Fixed in 2.4.30, 3.0.10 CWE-521

TI-2025-31223 CVE-2025-49143 · GHSA-rh67-4c8j-hjjh

Nautobot may allows uploaded media files to be accessible without authentication

LOW 28

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00457 Published 2025-06-10 Fixed in 1.6.32, 2.4.10 CWE-200

TI-2025-31222 CVE-2025-49142 · GHSA-wjw6-95h5-4jpx

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

LOW 27

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00385 Published 2025-06-10 Fixed in 1.6.32, 2.4.10 CWE-1336

TI-2024-23942 CVE-2024-36112 · GHSA-qmjf-wc2h-6x3q

Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

LOW 29

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00398 Published 2024-05-28 Fixed in 1.6.23, 2.2.5 CWE-280

TI-2024-23004 CVE-2024-34707 · GHSA-r2hr-4v48-fjv3

Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

LOW 34

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00606 Published 2024-05-13 Fixed in 1.6.22, 2.2.4 CWE-79

TI-2024-21845 CVE-2024-32979 · GHSA-jxgr-gcj5-cqqg

Reflected Cross-site Scripting potential in all object list views in Nautobot

LOW 33

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00491 Published 2024-05-01 Fixed in 1.6.20, 2.2.3 CWE-79

TI-2024-19368 CVE-2024-29199 · GHSA-m732-wvh2-7cq4

Unauthenticated views may expose information to anonymous users

LOW 25

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00628 Published 2024-03-26 Fixed in 1.6.16, 2.1.9 CWE-200

TI-2024-15445 CVE-2024-23345 · GHSA-v4xv-795h-rv4h

Nautobot has XSS potential in rendered Markdown fields

LOW 32

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application.

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.00433 Published 2024-01-22 Fixed in 2.1.2, 1.6.10 CWE-79

TI-2023-28300 CVE-2023-51649 · GHSA-vf5m-xrhm-v999

Nautobot missing object-level permissions enforcement when running Job Buttons

LOW 20

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00448 Published 2023-12-22 Fixed in 1.6.8, 2.1.0 CWE-863

TI-2023-27490 CVE-2023-50263 · GHSA-75mc-3pjc-727q

Nautobot allows unauthenticated db-file-storage views

LOW 25

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00748 Published 2023-12-12 Fixed in 1.6.7, 2.0.6 CWE-200

TI-2023-26544 CVE-2023-48705 · GHSA-cf9f-wmhp-v4pr

nautobot has XSS potential in custom links, job buttons, and computed fields

LOW 32

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected by a cross-site scripting vulnerability…

CVSS 3.1HIGH 7.1 Network Low privileges User interaction EPSS 0.00543 Published 2023-11-22 Fixed in 1.6.6, 2.0.5 CWE-79

TI-2023-24770 CVE-2023-46128 · GHSA-r2hw-74xv-4gqp

Exposure of hashed user passwords via REST API in Nautobot

LOW 30

Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00667 Published 2023-10-24 Fixed in 2.0.3 CWE-200

TI-2023-10938 CVE-2023-25657 · GHSA-8mfq-f5wj-vw5m

Remote code execution in Jinja2 template rendering in Nautobot

MEDIUM 46

Nautobot is a Network Source of Truth and Network Automation Platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01526 Published 2023-02-21 Fixed in 1.5.7 CWE-94

Vulnerabilities

Filters