en
CKAN is an open-source data management system and open data portal platform maintained by a global project community. It provides tools for publishing, organizing, discovering, storing, and accessing datasets through web applications, APIs, and extensible integrations.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-42032CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql` | Exploitation statusNot known exploited | FixYes | Affected productckan | Published05/13/2026 | SeverityMedium |
CVE-2026-41255CKAN: CSRF exemption primed by anonymous requests | Exploitation statusPublic exploit | FixYes | Affected productckan | Published05/13/2026 | SeverityMedium |
CVE-2026-41132CKAN: No certificate validation on STMP connection | Exploitation statusNot known exploited | FixYes | Affected productckan | Published05/13/2026 | SeverityMedium |
CVE-2026-42031CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` | Exploitation statusNot known exploited | FixYes | Affected productckan | Published05/13/2026 | SeverityHigh |
CVE-2025-64100CKAN Vulnerable to Session Cookie Fixation | Exploitation statusNot known exploited | FixYes | Affected productckan | Published10/29/2025 | SeverityMedium |
CVE-2025-54384CKAN stored XSS vulnerability in Markdown description fields | Exploitation statusNot known exploited | FixYes | Affected productckan | Published10/29/2025 | SeverityMedium |
CVE-2025-24372XSS vector in user uploaded images in group/org and user profiles in ckan | Exploitation statusNot known exploited | FixYes | Affected productckan | Published02/05/2025 | SeverityHigh |
CVE-2024-43371Potential access to sensitive URLs via CKAN extensions (SSRF) | Exploitation statusNot known exploited | FixNot confirmed | Affected productckan | Published08/21/2024 | SeverityMedium |
CVE-2024-41675CKAN has a Cross-site Scripting vector in the Datatables view plugin | Exploitation statusNot known exploited | FixYes | Affected productckan | Published08/21/2024 | SeverityMedium |
CVE-2024-41674CKAN may leak Solr credentials via error message in package_search action | Exploitation statusNot known exploited | FixYes | Affected productckan | Published08/21/2024 | SeverityMedium |
CVE-2024-27097Potential log injection in reset user endpoint in ckan | Exploitation statusNot known exploited | FixYes | Affected productckan | Published03/13/2024 | SeverityMedium |
CVE-2023-50248CKAN out of memory error when submitting the dataset form with a specially-crafted field | Exploitation statusNot confirmed | FixYes | Affected productckan | Published12/13/2023 | SeverityMedium |
CVE-2023-32696Excessive permissions for ckan user | Exploitation statusNot known exploited | FixNot confirmed | Affected productckan-docker-base | Published05/30/2023 | SeverityHigh |
CVE-2023-32321CKAN remote code execution and private information access via crafted resource ids | Exploitation statusNot known exploited | FixYes | Affected productckan | Published05/26/2023 | SeverityCritical |
CVE-2023-22746CKAN is vulnerable to session secret shared across instances using Docker images | Exploitation statusNot known exploited | FixNot confirmed | Affected productckan | Published02/03/2023 | SeverityHigh |
CVE-2021-25967CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload | Exploitation statusPublic exploit | FixNot confirmed | Affected productckan | Published12/01/2021 | SeverityMedium |
