JU
Product
jupyterhub
6
CVEs
0
On KEV
7.2
Max CVSS
1
New 30D
Severity mix
Critical 0High 1Medium 5Low 0
Watch
Add jupyterhub to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-41942 | 7.2 | Aug 8 | JupyterHub has a privilege escalation vulnerability with the `admin:users` scope Affected: < 4.1.6; >= 5.0.0, < 5.1.0 |
| CVE-2026-33709 | 6.1 | Apr 3 | JupyterHub has an Open Redirect Vulnerability Affected: < 5.4.4 |
| CVE-2024-28233 | 6.1 | Mar 27 | XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing Affected: < 4.1.0 |
| CVE-2026-54338 | 5.3 | Aug 7 | JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login Affected: < 5.5.0JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0. |
| CVE-2026-40864 | 4.3 | May 22 | JupyterHub: Cross-origin form POSTs bypass XSRF Affected: >= 4.1.0, < 5.4.5 |
| CVE-2026-108752 | 4.2 | Oct 11 | JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen Affected: through 6.0.1 |
Showing 6