geonode vulnerabilities
CVEs whose affected-version data names the geonode package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2024-27091Medium· 6.1GeoNode: Stored XSS to full account takeover
GeoNode: Stored XSS to full account takeover
CVE-2026-39921Medium· 6.3GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated user…
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malici…
CVE-2026-39922Medium· 6.3GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network reques…
GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network reques…
CVE-2023-40017High· 7.5GeoNode Server Side Request forgery
GeoNode Server Side Request forgery
CVE-2023-26043Medium· 6.5GeoServer style upload functionality vulnerable to XML External Entity (XXE) injection
GeoServer style upload functionality vulnerable to XML External Entity (XXE) injection
CVE-2023-42439High· 7.5GeoNode vulnerable to SSRF Bypass to return internal host data
GeoNode vulnerable to SSRF Bypass to return internal host data