geonode vulnerabilities

CVEs whose affected-version data names the geonode package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

6 CVEsRSS

CVE-2024-27091Medium· 6.1

2mo ago

GeoNode: Stored XSS to full account takeover

▾ Sunlitgeonode · geonodeEPSS 0.38%via GHSA

CVE-2026-39922Medium· 6.3

3mo ago

GeoNode contains a server-side request forgery vulnerability in the service registration endpoint

▾ Sunlitgeonode · geonodeEPSS 0.17%via GHSA

CVE-2026-39921Medium· 6.3

5mo ago

GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated user…

GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malici…

▾ Sunlitgeonode · geonodeEPSS 0.22%via OSV

CVE-2023-40017High· 7.5

1y ago

GeoNode Server Side Request forgery

▾ Twilightgeonode · geonodeEPSS 0.76%via OSV

CVE-2023-26043Medium· 6.5

2y ago

GeoServer style upload functionality vulnerable to XML External Entity (XXE) injection

▾ Sunlitgeonode · geonodeEPSS 0.84%via OSV

CVE-2023-42439High· 7.5

3y ago

GeoNode vulnerable to SSRF Bypass to return internal host data

▾ Twilightgeonode · geonodeEPSS 0.96%via OSV