CVE-2026-83805Medium 6.4Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs0.3%
CVE-2026-83801Medium 5.4Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text0.3%
CVE-2026-44794Medium 5.4Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference0.2%
CVE-2026-44796Medium 6.5Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)0.3%
CVE-2026-44797High 8.5Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)0.2%
CVE-2026-44798High 7.1Nautobot: GitRepository.current_head field should not be writable through REST API0.3%
CVE-2026-34203Low 2.7Nautobot: Management of users via REST API does not apply configured password validators0.3%
CVE-2025-49143Medium 6.3Nautobot may allows uploaded media files to be accessible without authentication0.5%
CVE-2025-49142Medium 6.0Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating0.4%
CVE-2024-36112Medium 6.3Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects0.4%
CVE-2024-34707High 7.5Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages0.6%
CVE-2024-32979High 7.5Reflected Cross-site Scripting potential in all object list views in Nautobot0.5%
CVE-2024-29199Low 3.7Unauthenticated views may expose information to anonymous users0.6%
CVE-2024-23345High 7.1Nautobot has XSS potential in rendered Markdown fields0.4%
CVE-2023-51649Low 3.5Nautobot missing object-level permissions enforcement when running Job Buttons0.4%