624 matches found
CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...
CVE-2026-86175
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses . Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, enabling unauthorized access to e...
EUVD-2026-71974
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...
CVE-2026-86175 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...
CVE-2026-86175: Insufficiently Protected Credentials
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...
PT-2026-86399
NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...
PT-2026-86400
Name of the Vulnerable Software and Affected Versions NetBox versions prior to 4.7.1 Description Authenticated users with view permissions can access private records of all users due to improper scoping of querysets. This issue affects the REST and GraphQL API endpoints for Notifications,...
CVE-2026-86176: Authorization Bypass Through User-Controlled Key
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...
CVE-2026-73229 vulnerabilities
Vulnerabilities for packages: awx, netbox-fips, authentik-fips, authentik, netbox...
GHSA-2M8G-3CMR-WG3W vulnerabilities
Vulnerabilities for packages: awx, netbox-fips, authentik-fips, authentik, netbox...
CVE-2026-73228 vulnerabilities
Vulnerabilities for packages: awx, netbox-fips, authentik-fips, authentik, netbox...
GHSA-G47C-3XMW-Q6M2 vulnerabilities
Vulnerabilities for packages: awx, netbox-fips, authentik-fips, authentik, netbox...
CVE-2026-59893 vulnerabilities
Vulnerabilities for packages: label-studio, openstack-horizon-2025.1-fips, openstack-keystone-2025.2, airflow-postgres-fips, openstack-placement-2025.2-fips, openstack-horizon-2025.2-fips, openstack-horizon-2025.1, superset, openstack-glance-2025.2, mlflow-fips, datahub-ingestion-fips,...
CVE-2026-54284 vulnerabilities
Vulnerabilities for packages: label-studio, openstack-horizon-2025.1-fips, openstack-keystone-2025.2, airflow-postgres-fips, openstack-placement-2025.2-fips, openstack-horizon-2025.2-fips, openstack-horizon-2025.1, superset, openstack-glance-2025.2, mlflow-fips, datahub-ingestion-fips,...
GHSA-PWGV-4X5Q-6M9F vulnerabilities
Vulnerabilities for packages: label-studio, openstack-horizon-2025.1-fips, openstack-keystone-2025.2, airflow-postgres-fips, openstack-placement-2025.2-fips, openstack-horizon-2025.2-fips, openstack-horizon-2025.1, superset, openstack-glance-2025.2, mlflow-fips, datahub-ingestion-fips,...
CVE-2026-59894 vulnerabilities
Vulnerabilities for packages: label-studio, openstack-horizon-2025.1-fips, openstack-keystone-2025.2, airflow-postgres-fips, openstack-placement-2025.2-fips, openstack-horizon-2025.2-fips, openstack-horizon-2025.1, superset, openstack-glance-2025.2, mlflow-fips, datahub-ingestion-fips,...
GHSA-3496-9G83-7V6X vulnerabilities
Vulnerabilities for packages: label-studio, openstack-horizon-2025.1-fips, openstack-keystone-2025.2, airflow-postgres-fips, openstack-placement-2025.2-fips, openstack-horizon-2025.2-fips, openstack-horizon-2025.1, superset, openstack-glance-2025.2, mlflow-fips, datahub-ingestion-fips,...
GHSA-PRG7-HCFM-MFCR vulnerabilities
Vulnerabilities for packages: label-studio, openstack-horizon-2025.1-fips, openstack-keystone-2025.2, airflow-postgres-fips, openstack-placement-2025.2-fips, openstack-horizon-2025.2-fips, openstack-horizon-2025.1, superset, openstack-glance-2025.2, mlflow-fips, datahub-ingestion-fips,...