MEDIUM6.1PyPI
GHSA-2hvh-cw5c-8q8q· CVE-2025-64100, PYSEC-2026-1246CKAN vulnerable to fixed session IDs
Modified: 7/7/2026
package
PyPI/ckan
pkg:pypi/ckan
MEDIUM6.3PyPI
GHSA-2r4h-8jxv-w2j8· CVE-2025-54384, PYSEC-2026-1247CKAN vulnerable to stored XSS in resource description
Modified: 7/7/2026
MEDIUM5.3PyPI
GHSA-2rqw-cfhc-35fh· CVE-2024-41674, PYSEC-2026-1248CKAN may leak Solr credentials via error message in package_search action
Modified: 7/7/2026
CRITICAL9.8PyPI
GHSA-446m-hmmm-hm8m· CVE-2023-32321, PYSEC-2026-312Ckan remote code execution and private information access via crafted resource ids
Modified: 9/10/2026
MEDIUM5.4PyPI
GHSA-6w9p-88qg-p3g3· CVE-2021-25967, PYSEC-2021-841Cross-site Scripting in CKAN
Modified: 9/13/2024
MEDIUM4.5PyPI
GHSA-7fgc-89cx-w8j5· CVE-2023-50248, PYSEC-2026-1249Out of memory error when submitting the dataset form with a specially-crafted field
Modified: 9/10/2026
HIGH7.3PyPI
GHSA-7pq5-qcp6-mcww· CVE-2025-24372, PYSEC-2026-1250CKAN has an XSS vector in user uploaded images in group/org and user profiles
Modified: 7/7/2026
MEDIUM4.3PyPI
GHSA-8g38-3m6v-232j· CVE-2024-27097, PYSEC-2026-1251Potential log injection in reset user endpoint in CKAN
Modified: 9/10/2026
MEDIUMPyPI
GHSA-cg4x-64p3-x59h· CVE-2026-42032, PYSEC-2026-2416CKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`
Modified: 7/13/2026
MEDIUM4.5PyPI
GHSA-g9ph-j5vj-f8wm· CVE-2024-43371, PYSEC-2026-1252Potential access to sensitive URLs via CKAN extensions (SSRF)
Modified: 7/7/2026
HIGHPyPI
GHSA-h7j7-3rx6-xvcg· CVE-2026-42031, PYSEC-2026-2417CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
Modified: 7/13/2026
HIGH8.8PyPI
GHSA-m2xp-jxfg-qq6g· CVE-2022-43685, PYSEC-2022-42987CKAN contains Improper Authentication leading to account takeover
Modified: 4/29/2025
MEDIUM6.1PyPI
GHSA-mcvf-jxcw-vj73· CVE-2026-41255, PYSEC-2026-2418CKAN has CSRF exemption primed by anonymous requests
Modified: 7/13/2026
MEDIUMPyPI
GHSA-mpfm-fpgx-647q· CVE-2026-41132, PYSEC-2026-2419CKAN has no certificate validation on STMP connection
Modified: 7/13/2026
MEDIUM6.8PyPI
GHSA-r3jc-vhf4-6v32· CVE-2024-41675, PYSEC-2026-1253CKAN has Cross-site Scripting vector in the Datatables view plugin
Modified: 7/7/2026
—PyPI
PYSEC-2021-841· CVE-2021-25967, GHSA-6w9p-88qg-p3g3Modified: 11/8/2023
—PyPI
PYSEC-2022-42987· CVE-2022-43685, GHSA-m2xp-jxfg-qq6gModified: 6/10/2026
MEDIUM6.1PyPI
PYSEC-2026-1246· CVE-2025-64100, GHSA-2hvh-cw5c-8q8qCKAN vulnerable to fixed session IDs
Modified: 7/7/2026
MEDIUM6.3PyPI
PYSEC-2026-1247· CVE-2025-54384, GHSA-2r4h-8jxv-w2j8CKAN vulnerable to stored XSS in resource description
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1248· CVE-2024-41674, GHSA-2rqw-cfhc-35fhCKAN may leak Solr credentials via error message in package_search action
Modified: 7/7/2026
MEDIUM4.5PyPI
PYSEC-2026-1249· CVE-2023-50248, GHSA-7fgc-89cx-w8j5Out of memory error when submitting the dataset form with a specially-crafted field
Modified: 7/7/2026
HIGH7.3PyPI
PYSEC-2026-1250· CVE-2025-24372, GHSA-7pq5-qcp6-mcwwCKAN has an XSS vector in user uploaded images in group/org and user profiles
Modified: 7/7/2026
MEDIUM4.3PyPI
PYSEC-2026-1251· CVE-2024-27097, GHSA-8g38-3m6v-232jPotential log injection in reset user endpoint in CKAN
Modified: 7/7/2026
MEDIUM4.5PyPI
PYSEC-2026-1252· CVE-2024-43371, GHSA-g9ph-j5vj-f8wmPotential access to sensitive URLs via CKAN extensions (SSRF)
Modified: 7/7/2026
MEDIUM6.8PyPI
PYSEC-2026-1253· CVE-2024-41675, GHSA-r3jc-vhf4-6v32CKAN has Cross-site Scripting vector in the Datatables view plugin
Modified: 7/7/2026
—PyPI
PYSEC-2026-2416· CVE-2026-42032, GHSA-cg4x-64p3-x59hCKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`
Modified: 7/13/2026
—PyPI
PYSEC-2026-2417· CVE-2026-42031, GHSA-h7j7-3rx6-xvcgCKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
Modified: 7/13/2026
MEDIUM6.1PyPI
PYSEC-2026-2418· CVE-2026-41255, GHSA-mcvf-jxcw-vj73CKAN has CSRF exemption primed by anonymous requests
Modified: 7/13/2026
—PyPI
PYSEC-2026-2419· CVE-2026-41132, GHSA-mpfm-fpgx-647qCKAN has no certificate validation on STMP connection
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-312· CVE-2023-32321, GHSA-446m-hmmm-hm8mCkan remote code execution and private information access via crafted resource ids
Modified: 7/2/2026