Skip to contentNautobot Nautobot vulnerabilities
- nautobotNautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobsCVE-2026-83805Fix available6.4 Medium
- nautobotNautobot: Stored cross-site scripting (XSS) in object create/edit form help textCVE-2026-83801Fix available5.4 Medium
- nautobotNautobot: GitRepository.current_head field should not be writable through REST APICVE-2026-44798Fix available7.1 High
- nautobotNautobot: Webhook definitions could be used for server-side request forgery (SSRF)CVE-2026-44797Fix available8.5 High
- nautobotNautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)CVE-2026-44796Fix available6.5 Medium
- nautobotNautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to referenceCVE-2026-44794Fix available5.4 Medium
- nautobotNautobot: Management of users via REST API does not apply configured password validatorsCVE-2026-34203Fix available2.7 Low
- nautobot nautobot-app-ssotNautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URLCVE-2025-62607Fix available5.3 Medium
- nautobotNautobot may allows uploaded media files to be accessible without authenticationCVE-2025-49143Fix available6.3 Medium
- nautobotNautobot vulnerable to secrets exposure and data manipulation through Jinja2 templatingCVE-2025-49142Fix available6.0 Medium
- nautobotNautobot dynamic-group-members doesn't enforce permission restrictions on member objectsCVE-2024-36112Fix available6.3 Medium
- nautobotNautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pagesCVE-2024-34707Fix available7.5 High
- nautobotReflected Cross-site Scripting potential in all object list views in NautobotCVE-2024-32979Fix available7.5 High
- nautobotUnauthenticated views may expose information to anonymous usersCVE-2024-29199Fix available3.7 Low
- nautobotNautobot has XSS potential in rendered Markdown fieldsCVE-2024-23345Fix available7.1 High
- nautobotNautobot missing object-level permissions enforcement when running Job ButtonsCVE-2023-51649Fix available3.5 Low
- nautobotNautobot allows unauthenticated db-file-storage viewsCVE-2023-50263Fix available3.7 Low
- nautobotnautobot has XSS potential in custom links, job buttons, and computed fieldsCVE-2023-48705Fix available7.1 High
- nautobot nautobot-plugin-device-onboardingClear Text Credentials Exposed via Onboarding TaskCVE-2023-48700Fix available5.7 Medium
- nautobotExposure of hashed user passwords via REST API in NautobotCVE-2023-46128Fix available6.5 Medium
- nautobotRemote code execution in Jinja2 template rendering in NautobotCVE-2023-25657Fix available7.5 High