Skip to content
Threat Feed
Subscribe

Vendor

GeoNetwork

3 briefs RSS
high advisory

Unauthenticated Server-Side Request Forgery in GeoNetwork Web Module

An unauthenticated server-side request forgery vulnerability (CVE-2026-55864) in the GeoNetwork SLD tool allows attackers to perform unauthorized outbound requests and potentially disclose internal XML data.

gn-web-app +1
1r 2t
high advisory

GeoNetwork Reflected XSS through Client-Side Template Injection (CVE-2026-39379)

A reflected Cross-Site Scripting (XSS) vulnerability, CVE-2026-39379, exists in GeoNetwork due to client-side template injection within error pages, allowing an attacker to craft a URL that, when visited by a victim, causes arbitrary JavaScript to execute in their browser in the context of their authenticated session.

GeoNetwork +3 xss web-vulnerability client-side-injection angularjs ghsa webserver
1r 4t
high advisory

GeoNetwork ACL Bypass in Elasticsearch Search (CVE-2026-46487)

A high-severity authorization bypass vulnerability, CVE-2026-46487, in GeoNetwork's Elasticsearch-backed search API allows unauthenticated attackers to retrieve restricted metadata records by bypassing access control and visibility filters when the request body omits the 'query' field, leading to sensitive information disclosure.

GeoNetwork +2 authorization-bypass information-disclosure web-vulnerability elasticsearch ghsa
3t