nautobot vulnerabilities
21 published CVEs name nautobot among the affected products.
- 21Published CVEs21 of them scored
- 7Last 12 monthspublished in the last year
- 0Critical7 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-83805
Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
nautobot · nautobot
Medium6.4 - CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
nautobot · nautobot
Medium5.4 - CVE-2026-44794
Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
nautobot · nautobot
Medium5.4 - CVE-2026-44796
Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
nautobot · nautobot
Medium6.5 - CVE-2026-44797
Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
nautobot · nautobot
High8.5 - CVE-2026-44798
Nautobot: GitRepository.current_head field should not be writable through REST API
nautobot · nautobot
High7.1 - CVE-2026-34203
Nautobot: Management of users via REST API does not apply configured password validators
nautobot · nautobot
Low2.7 - CVE-2025-62607
Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL
nautobot · nautobot-app-ssot
Medium5.3 - CVE-2025-49143
Nautobot may allows uploaded media files to be accessible without authentication
nautobot · nautobot
Medium6.3 - CVE-2025-49142
Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating
nautobot · nautobot
Medium6.0