https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-44798.htmlhttps://patchthecve.com/cve/CVE-2026-44798.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 7.1: Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could use the REST API to directly set the current_head field on the record, which was not intended to be user-editable. Doing so could cause Nauthttps://patchthecve.com/cve/CVE-2026-44797.htmlhttps://patchthecve.com/cve/CVE-2026-44797.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 8.5: Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could be configured by users with sufficient access to perform requests to various hosts and IP addresses that should not be permitted, allowing https://patchthecve.com/cve/CVE-2026-44796.htmlhttps://patchthecve.com/cve/CVE-2026-44796.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 6.5: Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in cohttps://patchthecve.com/cve/CVE-2026-44794.htmlhttps://patchthecve.com/cve/CVE-2026-44794.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 5.4: Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), wh