Medium
CVE-2026-83805
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 21
Reset filters
Medium
CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
Medium
CVE-2025-62607
Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL
Medium
CVE-2025-49143
Nautobot may allows uploaded media files to be accessible without authentication
High
CVE-2024-34707
Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
High
CVE-2024-32979
nautobot has reflected Cross-site Scripting potential in all object list views
Low
CVE-2024-29199
Unauthenticated views may expose information to anonymous users
High
CVE-2026-44798
Nautobot: GitRepository.current_head field should not be writable through REST API
High
CVE-2026-44797
Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
Medium
CVE-2026-44796
Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
Medium
CVE-2026-44794
Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
Low
CVE-2026-34203
Nautobot: Management of users via REST API does not apply configured password validators
High
CVE-2025-49142
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configur
Medium
CVE-2024-36112
Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI
High
CVE-2024-23345
XSS potential in rendered Markdown fields (comments, description, notes, etc.)
Low
CVE-2023-51649
Nautobot missing object-level permissions enforcement when running Job Buttons
Low
CVE-2023-50263
Unauthenticated db-file-storage views
High
CVE-2023-48705
Cross-site Scripting potential in custom links, job buttons, and computed fields
Medium
CVE-2023-48700
Clear Text Credentials Exposed via Onboarding Task
High
CVE-2023-46128
Nautobot vulnerable to exposure of hashed user passwords via REST API
High
CVE-2023-25657
Nautobot vulnerable to remote code execution via Jinja2 template rendering
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.