nautobot vulnerabilities

CVEs per yearBy the year they were published

1. 20236
2. 20245
3. 20253
4. 20267

Newest CVEs

• CVE-2026-83805

  Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

  nautobot · nautobot

  Medium6.4
• CVE-2026-83801

  Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

  nautobot · nautobot

  Medium5.4
• CVE-2026-44794

  Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

  nautobot · nautobot

  Medium5.4
• CVE-2026-44796

  Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

  nautobot · nautobot

  Medium6.5
• CVE-2026-44797

  Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

  nautobot · nautobot

  High8.5
• CVE-2026-44798

  Nautobot: GitRepository.current_head field should not be writable through REST API

  nautobot · nautobot

  High7.1
• CVE-2026-34203

  Nautobot: Management of users via REST API does not apply configured password validators

  nautobot · nautobot

  Low2.7
• CVE-2025-62607

  Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL

  nautobot · nautobot-app-ssot

  Medium5.3
• CVE-2025-49143

  Nautobot may allows uploaded media files to be accessible without authentication

  nautobot · nautobot

  Medium6.3
• CVE-2025-49142

  Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

  nautobot · nautobot

  Medium6.0