Log in Start free

nautobot

Products

ProductCVEsExploitedLatest
nautobot19–Sep 22, 2026
nautobot-app-ssot1–Oct 22, 2025
nautobot-plugin-device-onboarding1–Nov 21, 2023

Exploited and recent CVEs

  • CVE-2026-83805 Medium 6.4 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs 0.3%
  • CVE-2026-83801 Medium 5.4 Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text 0.3%
  • CVE-2026-44794 Medium 5.4 Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference 0.2%
  • CVE-2026-44796 Medium 6.5 Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS) 0.3%
  • CVE-2026-44797 High 8.5 Nautobot: Webhook definitions could be used for server-side request forgery (SSRF) 0.2%
  • CVE-2026-44798 High 7.1 Nautobot: GitRepository.current_head field should not be writable through REST API 0.3%
  • CVE-2026-34203 Low 2.7 Nautobot: Management of users via REST API does not apply configured password validators 0.3%
  • CVE-2025-62607 Medium 5.3 Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL 0.3%
  • CVE-2025-49143 Medium 6.3 Nautobot may allows uploaded media files to be accessible without authentication 0.5%
  • CVE-2025-49142 Medium 6.0 Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating 0.4%
  • CVE-2024-36112 Medium 6.3 Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects 0.4%
  • CVE-2024-34707 High 7.5 Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages 0.6%
  • CVE-2024-32979 High 7.5 Reflected Cross-site Scripting potential in all object list views in Nautobot 0.5%
  • CVE-2024-29199 Low 3.7 Unauthenticated views may expose information to anonymous users 0.6%
  • CVE-2024-23345 High 7.1 Nautobot has XSS potential in rendered Markdown fields 0.4%
  • CVE-2023-51649 Low 3.5 Nautobot missing object-level permissions enforcement when running Job Buttons 0.4%
  • CVE-2023-50263 Low 3.7 Nautobot allows unauthenticated db-file-storage views 0.7%
  • CVE-2023-48705 High 7.1 nautobot has XSS potential in custom links, job buttons, and computed fields 0.5%
  • CVE-2023-48700 Medium 5.7 Clear Text Credentials Exposed via Onboarding Task 0.4%
  • CVE-2023-46128 Medium 6.5 Exposure of hashed user passwords via REST API in Nautobot 0.7%
  • CVE-2023-25657 High 7.5 Remote code execution in Jinja2 template rendering in Nautobot 1.5%