https://db.gcve.eu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 30 Jun 2026 21:25:40 +0000 https://db.gcve.eu/sighting/3654c23d-189a-4c87-92d1-712597ef400c/export {"uuid": "3654c23d-189a-4c87-92d1-712597ef400c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-RH67-4C8J-HJJH", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17956", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-49143\n\ud83d\udd25 CVSS Score: 6.3 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N)\n\ud83d\udd39 Description: Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIA_ROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by anonymous users who know or can guess the correct URL for a given file. Nautobot v2.4.10 and v1.6.32 address this issue by adding enforcement of Nautobot user authentication to this endpoint.\n\ud83d\udccf Published: 2025-06-10T15:43:59.225Z\n\ud83d\udccf Modified: 2025-06-10T18:12:01.967Z\n\ud83d\udd17 References:\n1. https://github.com/nautobot/nautobot/security/advisories/GHSA-rh67-4c8j-hjjh\n2. https://github.com/nautobot/nautobot/pull/6672\n3. https://github.com/nautobot/nautobot/pull/6703\n4. https://github.com/nautobot/nautobot/commit/9c892dc300429948a4714f743c9c2879d8987340\n5. https://github.com/nautobot/nautobot/commit/d99a53b065129cff3a0fa9abe7355a9ef1ad4c95", "creation_timestamp": "2025-06-10T18:33:07.000000Z"} {"uuid": "3654c23d-189a-4c87-92d1-712597ef400c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-RH67-4C8J-HJJH", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17956", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-49143\n\ud83d\udd25 CVSS Score: 6.3 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N)\n\ud83d\udd39 Description: Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIA_ROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by anonymous users who know or can guess the correct URL for a given file. Nautobot v2.4.10 and v1.6.32 address this issue by adding enforcement of Nautobot user authentication to this endpoint.\n\ud83d\udccf Published: 2025-06-10T15:43:59.225Z\n\ud83d\udccf Modified: 2025-06-10T18:12:01.967Z\n\ud83d\udd17 References:\n1. https://github.com/nautobot/nautobot/security/advisories/GHSA-rh67-4c8j-hjjh\n2. https://github.com/nautobot/nautobot/pull/6672\n3. https://github.com/nautobot/nautobot/pull/6703\n4. https://github.com/nautobot/nautobot/commit/9c892dc300429948a4714f743c9c2879d8987340\n5. https://github.com/nautobot/nautobot/commit/d99a53b065129cff3a0fa9abe7355a9ef1ad4c95", "creation_timestamp": "2025-06-10T18:33:07.000000Z"} https://db.gcve.eu/sighting/3654c23d-189a-4c87-92d1-712597ef400c/export Tue, 10 Jun 2025 18:33:07 +0000