jupyter-server vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20222
3. 20233
4. 20242
5. 202610

Newest CVEs

• CVE-2026-114135

  Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

  jupyter-server · jupyter_server

  High8.8
• CVE-2026-86049

  Jupyter Server: 5xx request logging leaks token-bearing Referer header values

  jupyter-server · jupyter_server

  High7.1
• CVE-2026-44182

  Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering

  jupyter-server · enterprise_gateway

  Critical10.0
• CVE-2026-44181

  Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution

  jupyter-server · enterprise_gateway

  Critical10.0
• CVE-2026-44180

  Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed

  jupyter-server · enterprise_gateway

  Critical9.8
• CVE-2026-44727

  Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

  jupyter-server · jupyter_server

  Critical9.3
• CVE-2026-40934

  jupyter-server authentication cookies remain valid after password reset due to static cookie secret

  jupyter-server · jupyter_server

  High7.6
• CVE-2026-40110

  jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat

  jupyter-server · jupyter_server

  High7.6
• CVE-2026-35397

  jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

  jupyter-server · jupyter_server

  High7.6
• CVE-2025-61669

  jupyter_server next parameter open redirect can redirect users to external domains

  jupyter-server · jupyter_server

  Medium6.3