nautobot

7 results · Clear filters · Feed

• High 8.5
  CVE-2026-44797

  Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

  Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresse…

  nautobot nautobot nautobot PyPI
  May 28, 2026
• High 7.1
  CVE-2026-44798

  Nautobot: GitRepository.current_head field should not be writable through REST API

  Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could use the REST API to directly set the current_head field on the record, which was not intended to be…

  nautobot nautobot nautobot PyPI
  May 28, 2026
• High 7.5
  CVE-2024-34707

  Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

  Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the `BANNER_TOP`, `BANNER_BOTTOM`, and `BANNER_LOGIN` configuration settings via the `/admin/constance/config/` endpoint. Normally these se…

  nautobot nautobot nautobot PyPI
  May 13, 2024
• High 7.5
  CVE-2024-32979

  Reflected Cross-site Scripting potential in all object list views in Nautobot

  Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query paramete…

  nautobot nautobot nautobot PyPI
  May 1, 2024
• High 7.1
  CVE-2024-23345

  Nautobot has XSS potential in rendered Markdown fields

  Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitizatio…

  nautobot nautobot nautobot PyPI
  Jan 22, 2024
• High 7.1
  CVE-2023-48705

  nautobot has XSS potential in custom links, job buttons, and computed fields

  Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are potentially affected by a cross-site scripting vulnerability. Due to incorrect usage of Django's `m…

  nautobot nautobot nautobot PyPI
  Nov 22, 2023
• High 7.5
  CVE-2023-25657

  Remote code execution in Jinja2 template rendering in Nautobot

  Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code execution vulnerability. Nautobot did not properly sandbox Jinja2 template rendering. In Nautobot 1.5.7 has …

  nautobot nautobot nautobot PyPI
  Feb 21, 2023