Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-46429

GeoNode: Unrestricted File Upload

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remote user to store and serve malicious files. This issue is fixed in version 5.0.3.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Geonode
Products
Geonode
CVE-2026-55649

GeoNode has Stored XSS in Documents metadata abstract field

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Geonode
Products
Geonode
CVE-2026-33050

GeoNode: OS command injection via uploaded file layer name

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Geonode
Products
Geonode
CVE-2026-39922

GeoNode SSRF via Service Registration

GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Geonode Geosolutionsgroup
Products
Geonode Geonode
CVE-2026-39921

GeoNode < 4.4.5, 5.0.2 SSRF via Document Upload

GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Geonode Geosolutionsgroup
Products
Geonode Geonode