Jjupyter-server

Products

Exploited and recent CVEs

• CVE-2026-114135 High 8.8 Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization 0.5%
• CVE-2026-86049 High 7.1 Jupyter Server: 5xx request logging leaks token-bearing Referer header values 0.4%
• CVE-2026-44182 Critical 10.0 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering 0.6%
• CVE-2026-44181 Critical 10.0 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution 0.8%
• CVE-2026-44180 Critical 9.8 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed 0.7%
• CVE-2026-44727 Critical 9.0 Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP 0.4%
• CVE-2026-40934 High 7.6 jupyter-server authentication cookies remain valid after password reset due to static cookie secret 0.3%
• CVE-2026-40110 High 7.1 jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat 0.3%
• CVE-2026-35397 High 7.1 jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix 0.6%
• CVE-2025-61669 Medium 6.3 jupyter_server next parameter open redirect can redirect users to external domains 0.2%
• CVE-2024-35178 High 7.5 Jupyter server on Windows discloses Windows user password hash 0.8%
• CVE-2024-28188 Medium 5.3 jupyter-scheduler's endpoint is missing authentication 0.3%
• CVE-2023-49080 Low 3.5 Jupyter Server errors include tracebacks with path information 0.8%
• CVE-2023-39968 Medium 4.3 Open Redirect Vulnerability in jupyter-server 0.7%
• CVE-2023-40170 Medium 4.6 cross-site inclusion (XSSI) of files in jupyter-server 0.6%
• CVE-2022-29241 High 7.1 Known or guessable hidden files may be accessed in Jupyter Server 1.0%
• CVE-2022-24757 High 7.5 Sensitive Auth & Cookie data stored in Jupyter server logs 1.3%
• CVE-2020-26275 Medium 6.1 Open redirect vulnerability 1.4%