okfn records
14 published records for vendor okfn.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 85.7%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2
- CWE-20 Improper Input Validation1
- CWE-209 Generation of Error Message Containing Sensitive Information1
- CWE-269 Improper Privilege Management1
- CWE-295 Improper Certificate Validation1
- CWE-330 Use of Insufficiently Random Values1
The weakness classes this vendor ships most often: where to look.
CWEAll records
14 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2023-32321No exploit | CKAN remote code execution and private information access via crafted resource idsokfn · ckan · CWE-20 | Critical9.8 | — | 1.6% | May 26, 2023 |
35Monitor | CVE-2023-32696No exploit | Excessive permissions for ckan userokfn · ckan · CWE-269 | High8.8 | — | 0.7% | May 30, 2023 |
35Monitor | CVE-2022-43685No exploit | CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request.okfn · ckan · CWE-862 | High8.8 | — | 0.7% | Nov 21, 2022 |
34Monitor | CVE-2026-42031Proof of concept | CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`okfn · ckan · CWE-89 | High8.3 | — | 1.8% | May 13, 2026 |
30Monitor | CVE-2023-22746No exploit | CKAN is vulnerable to session secret shared across instances using Docker imagesokfn · ckan · CWE-330 | High7.5 | — | 0.6% | Feb 3, 2023 |
26Monitor | CVE-2023-50248No exploit | CKAN out of memory error when submitting the dataset form with a specially-crafted fieldokfn · ckan · CWE-130 | Medium6.5 | — | 0.5% | Dec 13, 2023 |
26Monitor | CVE-2024-43371No exploit | Potential access to sensitive URLs via CKAN extensions (SSRF)okfn · ckan · CWE-918 | Medium6.5 | — | 0.3% | Aug 21, 2024 |
26Monitor | CVE-2026-42032No exploit | CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`okfn · ckan · CWE-863 | Medium6.7 | — | 0.3% | May 13, 2026 |
26Monitor | CVE-2026-41132No exploit | CKAN: No certificate validation on STMP connectionokfn · ckan · CWE-295 | Medium6.6 | — | 0.1% | May 13, 2026 |
24Monitor | CVE-2024-41675No exploit | CKAN has a Cross-site Scripting vector in the Datatables view pluginokfn · ckan · CWE-79 | Medium6.1 | — | 0.4% | Aug 21, 2024 |
24Monitor | CVE-2026-41255No exploit | CKAN: CSRF exemption primed by anonymous requestsokfn · ckan · CWE-352 | Medium6.1 | — | 0.1% | May 13, 2026 |
21Monitor | CVE-2021-25967No exploit | CKAN - Stored Cross-Site Scripting (XSS) via SVG File Uploadokfn · ckan · CWE-79 | Medium5.4 | — | 0.5% | Dec 1, 2021 |
21Monitor | CVE-2024-27097No exploit | Potential log injection in reset user endpoint in ckanokfn · ckan · CWE-532 | Medium5.3 | — | 0.4% | Mar 13, 2024 |
21Monitor | CVE-2024-41674No exploit | CKAN may leak Solr credentials via error message in package_search actionokfn · ckan · CWE-209 | Medium5.3 | — | 0.3% | Aug 21, 2024 |
- CVE-2023-3232140Plan
CKAN remote code execution and private information access via crafted resource ids
CriticalCVSS 9.8No exploitEPSS 1%okfn · ckanMay 26, 2023
- CVE-2023-3269635Monitor
Excessive permissions for ckan user
HighCVSS 8.8No exploitEPSS 0%okfn · ckanMay 30, 2023
- CVE-2022-4368535Monitor
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request.
HighCVSS 8.8No exploitEPSS 0%okfn · ckanNov 21, 2022
- CVE-2026-4203134Monitor
CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
HighCVSS 8.3Proof of conceptEPSS 1%okfn · ckanMay 13, 2026
- CVE-2023-2274630Monitor
CKAN is vulnerable to session secret shared across instances using Docker images
HighCVSS 7.5No exploitEPSS 0%okfn · ckanFeb 3, 2023
- CVE-2023-5024826Monitor
CKAN out of memory error when submitting the dataset form with a specially-crafted field
MediumCVSS 6.5No exploitEPSS 0%okfn · ckanDec 13, 2023
- CVE-2024-4337126Monitor
Potential access to sensitive URLs via CKAN extensions (SSRF)
MediumCVSS 6.5No exploitEPSS 0%okfn · ckanAug 21, 2024
- CVE-2026-4203226Monitor
CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`
MediumCVSS 6.7No exploitEPSS 0%okfn · ckanMay 13, 2026
- CVE-2026-4113226Monitor
CKAN: No certificate validation on STMP connection
MediumCVSS 6.6No exploitEPSS 0%okfn · ckanMay 13, 2026
- CVE-2024-4167524Monitor
CKAN has a Cross-site Scripting vector in the Datatables view plugin
MediumCVSS 6.1No exploitEPSS 0%okfn · ckanAug 21, 2024
- CVE-2026-4125524Monitor
CKAN: CSRF exemption primed by anonymous requests
MediumCVSS 6.1No exploitEPSS 0%okfn · ckanMay 13, 2026
- CVE-2021-2596721Monitor
CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload
MediumCVSS 5.4No exploitEPSS 0%okfn · ckanDec 1, 2021
- CVE-2024-2709721Monitor
Potential log injection in reset user endpoint in ckan
MediumCVSS 5.3No exploitEPSS 0%okfn · ckanMar 13, 2024
- CVE-2024-4167421Monitor
CKAN may leak Solr credentials via error message in package_search action
MediumCVSS 5.3No exploitEPSS 0%okfn · ckanAug 21, 2024