Medium
CVE-2024-22420
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 67
Reset filters
High
CVE-2024-22421
JupyterLab vulnerable to potential authentication and CSRF tokens leak
Critical
CVE-2026-44727
Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
High
CVE-2026-54293
Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
Critical
CVE-2026-44182
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
Critical
CVE-2026-44181
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
High
CVE-2026-5241
huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
High
CVE-2026-42266
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
High
CVE-2026-44721
open-webui Vulnerable to Stored XSS via Model Description
High
CVE-2026-40171
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
Medium
CVE-2026-39378
nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding
Medium
CVE-2026-39377
nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
Critical
Exploited in attacks
CVE-2026-39987
Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
Medium
CVE-2026-33709
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links whi
Medium
CVE-2025-51481
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the not
Medium
ghsa-gj55-2xf9-67rq
HTML injection in JupyterLite leading to DOM Clobbering
High
CVE-2024-43805
HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
Medium
CVE-2024-35225
Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.
Critical
CVE-2024-28179
Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server
Critical
CVE-2024-27133
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerabil
Critical
CVE-2024-27132
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.
Medium
CVE-2021-32862
nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths
Medium
CVE-2022-29238
Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only
High
CVE-2022-29241
Jupyter server Token bruteforcing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.