Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how jupyter compares to other vendors in security performance

View Risk Score →

jupyter Jupyter ServerXSS

Risk 33
Severity
7
First published (updated )
REDHAT-BUG-2491516

pip/jupyterlab-gitjupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

Risk 48
Severity
7.1
First published (updated )
CVE-2026-54528

jupyter jupyterlab-gitJupyterLab Git: Stored XSS leading to RCE

Risk 80
Severity
9.3
First published (updated )
CVE-2026-54527

pip/jupyter-serverJupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

Risk 80
Severity
9.3
First published (updated )
CVE-2026-44727

pypi/jupyter-serverCORS Origin Validation Bypass in jupyter-server

Risk 77
Severity
8.8
First published (updated )
CVE-2026-6657
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

pypi/jupyter-serverPath Traversal in jupyter/jupyter

Risk 60
Severity
8.1
First published (updated )
CVE-2026-5422

jupyter JupyterLabjupyterlab is an extensible environment for interactive and reproducible computing, based on the Jup…

Risk 33
Severity
7
First published (updated )
REDHAT-BUG-2477086

pip/notebookjupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content

Risk 80
Severity
8.6
First published (updated )
CVE-2026-42557

jupyter Jupyter NotebookIn Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the cor…

Risk 33
Severity
7
First published (updated )
REDHAT-BUG-2467453

pip/jupyterlabJupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

Risk 79
Severity
8.8
First published (updated )
CVE-2026-42266
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

jupyter Jupyter ServerPath Traversal

Risk 33
Severity
7
First published (updated )
REDHAT-BUG-2466858

pip/jupyterhubJupyterHub: Cross-origin form POSTs bypass XSRF

Risk 34
Severity
5.4
First published (updated )
CVE-2026-40864

pip/jupyter-serverjupyter-server authentication cookies remain valid after password reset due to static cookie secret

Risk 56
Severity
7.6
First published (updated )
CVE-2026-40934

pip/jupyter-serverjupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat

Risk 63
Severity
7.6
First published (updated )
CVE-2026-40110

pip/jupyter-serverjupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

Risk 79
Severity
7.6
First published (updated )
CVE-2026-35397
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

pypi/jupyter_serverjupyter_server next parameter open redirect can redirect users to external domains

Risk 39
Severity
6.3
First published (updated )
CVE-2025-61669

pypi/nbconvertnbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

Risk 37
Severity
6.5
First published (updated )
CVE-2026-39378

pypi/nbconvertnbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

Risk 37
Severity
6.5
First published (updated )
CVE-2026-39377

pip/jupyterhub-ltiauthenticatorLTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)

Risk 35
Severity
5.9
First published (updated )
CVE-2026-34052

pip/jupyterhubJupyterHub has an Open Redirect Vulnerability

Risk 38
Severity
5.1
First published (updated )
CVE-2026-33709
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

pip/oauthenticatorOAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims

Risk 79
Severity
8.8
First published (updated )
CVE-2026-33175

pypi/nbconvertnbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

Risk 72
Severity
8.5
First published (updated )
CVE-2025-53000

pip/jupyterlabJupyterLab LaTeX typesetter links did not enforce `noopener` attribute

Risk 22
Severity
4.3
First published (updated )
CVE-2025-59842

jupyter JupyterLabJupyterLab Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Risk 38
First published (updated )
Advisory
ZDI-25-339

IBM Cognos AnalyticsJupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Risk 64
Severity
7.3
First published (updated )
CVE-2025-30167
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

pip/jupyterhub-ltiauthenticatorJupyterHub's LTI13Authenticator: JWT signature not validated

Risk 87
Severity
10
First published (updated )
CVE-2023-25574

pip/jupyterlabHTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

Risk 60
Severity
7.6
First published (updated )
CVE-2024-43805

jupyter JupyterHubJupyterHub has a privilege escalation vulnerability with the `admin:users` scope

Risk 69
Severity
7.2
First published (updated )
CVE-2024-41942

Project Jupyter JupyterLab extension templateRemote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action

Risk 83
Severity
10
First published (updated )
CVE-2024-39700

pip/jupyter-server-proxyJupyter Server Proxy has a reflected XSS issue in host parameter

Risk 84
Severity
9.7
First published (updated )
CVE-2024-35225
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203