geonode (4.4.5), mayan-edms (>=4.6.13, <=4.7.9) +4 more potentially affected by CVE-2026-48587 via django (4.2.29)

django PYPI version 4.2.29 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - geonode 4.4.5 - mayan-edms =4.6.13, =7.4.0, =7.4.0, =4.0.17, =4.0.18 - pheme 21.12.1 Source cves: CVE-2026-48587 Source advisory:...

djangodjangodjango (4.2.24), geonode (4.4.4) +1 more potentially affected by CVE-2026-8404 via django (4.2.24)

django PYPI version 4.2.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - djangodjangodjango 4.2.24 - geonode 4.4.4 - mayan-edms =4.6.10, =4.10.0 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

geonode (4.4.5), mayan-edms (>=4.6.13, <=4.7.9) +4 more potentially affected by CVE-2026-8404 via django (4.2.29)

django PYPI version 4.2.29 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - geonode 4.4.5 - mayan-edms =4.6.13, =7.4.0, =7.4.0, =4.0.17, =4.0.18 - pheme 21.12.1 Source cves: CVE-2026-8404 Source advisory:...

agave (0.2.3.dev0), ai-shell-agent (>=0.2.0, <=0.2.2) +30 more potentially affected by CVE-2026-8643 via pip (25.0.1)

pip PYPI version 25.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - agave 0.2.3.dev0 - ai-shell-agent =0.2.0, =0.74.3, =0.1.1, =1.31.4, =0.0.1, =0.0.1, =4.4.3, =0.1.0, =0.1.1 - iflow-mcp-iflytek-ifly-workflow-mcp-server...

geonode (>=4.0.0, <=4.0.0.post1), jpeglib (0.10.16) potentially affected by CVE-2026-8643 via pip (22.2.1)

pip PYPI version 22.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - geonode =4.0.0, =4.0.0.post1 - jpeglib 0.10.16 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

geonode (>=4.0.0, <=4.0.0.post1), jpeglib (0.10.16) potentially affected by CVE-2026-8643 via pip (22.2.1)

pip PYPI version 22.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - geonode =4.0.0, =4.0.0.post1 - jpeglib 0.10.16 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

arvados-cwl-runner (>=2.6.0rc3, <=2.7.4), db-classifier (0.0.2) +18 more potentially affected by CVE-2026-44897 via mistune (2.0.5)

mistune PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - arvados-cwl-runner =2.6.0rc3, =2.0.5, =4.1.0, =0.8.4, =2.1.1, =1.0.0, =2.2.0, =0.0.1, =2.4.1rc3, =8.3.20221209165047, =8.5.20240102191335 - sitefa...

geonode (3.3.3) potentially affected by CVE-2026-42304 via twisted (22.4.0rc1)

twisted PYPI version 22.4.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - geonode 3.3.3 Source cves: CVE-2026-42304 Source advisory: OSV:PYSEC-2026-160...

binance-futures-connector (>=1.8.0, <=1.10.0), geonode (4.0.0rc0) +1 more potentially affected by CVE-2026-42304 via twisted (22.2.0)

twisted PYPI version 22.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-futures-connector =1.8.0, =1.10.0 - geonode 4.0.0rc0 - nucypher 6.0.0 Source cves: CVE-2026-42304 Source advisory: OSV:PYSEC-2026-160...

carml (>=22.7.0, <=22.7.1), clutch-co-scraper (1.0.0) +6 more potentially affected by CVE-2026-42304 via twisted (22.4.0)

twisted PYPI version 22.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml =22.7.0, =4.1.0, =4.0.0rc1, =0.0.1, =0.0.2 - nucypher 6.1.0 - pterodactyl-exporter 0.1.0 Source cves: CVE-2026-42304 Source advisory:...

ezmote-cmdserver (>=0.7.2, <=0.7.11), geonode (4.0.1) +7 more potentially affected by CVE-2026-42304 via twisted (22.8.0)

twisted PYPI version 22.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - ezmote-cmdserver =0.7.2, =0.0.4, =0.1.0, =0.9.2, =1.5.2, =0.0.0, =1.0.0, =1.0.3 Source cves: CVE-2026-42304 Source advisory: OSV:PYSEC-2026-160...

arvados-cwl-runner (>=2.6.0rc3, <=2.7.4), db-classifier (0.0.2) +18 more potentially affected by CVE-2026-44896 via mistune (2.0.5)

mistune PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - arvados-cwl-runner =2.6.0rc3, =2.0.5, =4.1.0, =0.8.4, =2.1.1, =1.0.0, =2.2.0, =0.0.1, =2.4.1rc3, =8.3.20221209165047, =8.5.20240102191335 - sitefa...

binance-futures-connector (>=1.8.0, <=1.10.0), geonode (4.0.0rc0) +1 more potentially affected by CVE-2026-42304 via twisted (22.2.0)

twisted PYPI version 22.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-futures-connector =1.8.0, =1.10.0 - geonode 4.0.0rc0 - nucypher 6.0.0 Source cves: CVE-2026-42304 Source advisory: OSV:GHSA-GRGV-6HW6-V9G...

geonode (3.3.3) potentially affected by CVE-2026-42304 via twisted (22.4.0rc1)

twisted PYPI version 22.4.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - geonode 3.3.3 Source cves: CVE-2026-42304 Source advisory: OSV:GHSA-GRGV-6HW6-V9G4...

ezmote-cmdserver (>=0.7.2, <=0.7.11), geonode (4.0.1) +7 more potentially affected by CVE-2026-42304 via twisted (22.8.0)

twisted PYPI version 22.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - ezmote-cmdserver =0.7.2, =0.0.4, =0.1.0, =0.9.2, =1.5.2, =0.0.0, =1.0.0, =1.0.3 Source cves: CVE-2026-42304 Source advisory: OSV:GHSA-GRGV-6HW6-V...

geonode (>=4.0.0, <=4.0.0.post1), jpeglib (0.10.16) potentially affected by CVE-2026-6357 via pip (22.2.1)

pip PYPI version 22.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - geonode =4.0.0, =4.0.0.post1 - jpeglib 0.10.16 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

aiomobilevikings (0.1.0), aiorobonect (>=1.1.0, <=1.1.3) +5 more potentially affected by CVE-2026-6357 via pip (24.1.2)

pip PYPI version 24.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aiomobilevikings 0.1.0 - aiorobonect =1.1.0, =0.4.0, =4.4.0, =2.0.0.post0, =2.0.2 Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...

geonode (>=4.0.0, <=4.0.0.post1), jpeglib (0.10.16) potentially affected by CVE-2026-3219 via pip (22.2.1)

pip PYPI version 22.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - geonode =4.0.0, =4.0.0.post1 - jpeglib 0.10.16 Source cves: CVE-2026-3219 Source advisory: OSV:GHSA-58QW-9MGM-455V...

CVE-2026-39922

GeoNode versions 4.4.5 and 5.0.2 and prior within their respective releases contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL durin...

CVE-2026-39921

GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the docurl parameter during document upload...