Ckan vulnerabilities

Products

• Ckan 15

Newest

• ckan CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql` CVE-2026-42032 Fix available 6.7 MediumApril 30, 2026
• ckan CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` CVE-2026-42031 Public exploitFix available 8.3 HighApril 29, 2026
• ckan CKAN: CSRF exemption primed by anonymous requests CVE-2026-41255 Fix available 6.1 MediumApril 29, 2026
• ckan CKAN: No certificate validation on STMP connection CVE-2026-41132 Fix available 6.6 MediumApril 29, 2026
• ckan CKAN Vulnerable to Session Cookie Fixation CVE-2025-64100 Fix available 6.1 MediumOctober 29, 2025
• ckan CKAN stored XSS vulnerability in Markdown description fields CVE-2025-54384 Fix available 6.3 MediumOctober 29, 2025
• ckan XSS vector in user uploaded images in group/org and user profiles in ckan CVE-2025-24372 Fix available 7.3 HighFebruary 5, 2025
• ckan Potential access to sensitive URLs via CKAN extensions (SSRF) CVE-2024-43371 Fix available 4.5 MediumAugust 21, 2024
• ckan CKAN has a Cross-site Scripting vector in the Datatables view plugin CVE-2024-41675 Fix available 6.8 MediumAugust 21, 2024
• ckan CKAN may leak Solr credentials via error message in package_search action CVE-2024-41674 Fix available 5.3 MediumAugust 21, 2024
• ckan Potential log injection in reset user endpoint in ckan CVE-2024-27097 Fix available 4.3 MediumMarch 13, 2024
• ckan CKAN out of memory error when submitting the dataset form with a specially-crafted field CVE-2023-50248 Fix available 4.5 MediumDecember 13, 2023
• okfn ckan, ckan ckan-docker-base +1 more Excessive permissions for ckan user CVE-2023-32696 8.8 HighMay 30, 2023
• ckan CKAN remote code execution and private information access via crafted resource ids CVE-2023-32321 Fix available 9.8 CriticalMay 24, 2023
• ckan CKAN is vulnerable to session secret shared across instances using Docker images CVE-2023-22746 8.6 HighFebruary 3, 2023
• ckan CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload CVE-2021-25967 Fix available 5.4 MediumDecember 1, 2021