JU
Vendor
jupyterhub
19
CVEs
0
On KEV
1
New 30D
Products
JU7.2
jupyterhub
jupyterhub
6 CVEs0 on KEV1 new
OA9.1
oauthenticator
jupyterhub
3 CVEs0 on KEV0 new
JU9.8
jupyter-server-proxy
jupyterhub
2 CVEs0 on KEV0 new
LT9.8
ltiauthenticator
jupyterhub
2 CVEs0 on KEV0 new
DO4.3
dockerspawner
jupyterhub
1 CVEs0 on KEV0 new
FU9.8
First Use Authenticator
Jupyterhub
1 CVEs0 on KEV0 new
JU9.0
jupyter-remote-desktop-proxy
jupyterhub
1 CVEs0 on KEV0 new
KU8.1
Kubespawner
Jupyterhub
1 CVEs0 on KEV0 new
NB8.8
Nbgitpuller
Jupyterhub
1 CVEs0 on KEV0 new
SY7.9
Systemdspawner
Jupyterhub
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-108752 | JU jupyterhub jupyterhub | 4.2 | Oct 11 | JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen |
| CVE-2026-54338 | JU jupyterhub jupyterhub | 5.3 | Aug 7 | JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login |
| CVE-2026-40864 | JU jupyterhub jupyterhub | 4.3 | May 22 | JupyterHub: Cross-origin form POSTs bypass XSRF |
| CVE-2026-34052 | LT ltiauthenticator jupyterhub | 5.9 | Apr 3 | LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service) |
| CVE-2026-33709 | JU jupyterhub jupyterhub | 6.1 | Apr 3 | JupyterHub has an Open Redirect Vulnerability |
| CVE-2026-33175 | OA oauthenticator jupyterhub | 8.8 | Apr 3 | OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims |
| CVE-2025-32428 | JU jupyter-remote-desktop-proxy jupyterhub | 9.0 | Apr 14 | Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended |
| CVE-2023-25574 | LT ltiauthenticator jupyterhub | 9.8 | Feb 25 | JupyterHub's LTI13Authenticator: JWT signature not validated |
| CVE-2024-41942 | JU jupyterhub jupyterhub | 7.2 | Aug 8 | JupyterHub has a privilege escalation vulnerability with the `admin:users` scope |
| CVE-2024-37300 | OA oauthenticator jupyterhub | 8.1 | Jun 12 | Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0 |
| CVE-2024-35225 | JU jupyter-server-proxy jupyterhub | 6.1 | Jun 11 | Jupyter Server Proxy has a reflected XSS issue in host parameter |
| CVE-2024-28233 | JU jupyterhub jupyterhub | 6.1 | Mar 27 | XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing |
| CVE-2024-29033 | OA oauthenticator jupyterhub | 9.1 | Mar 20 | GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace |
| CVE-2024-28179 | JU jupyter-server-proxy jupyterhub | 9.8 | Mar 20 | Jupyter Server Proxy's Websocket Proxying does not require authentication |
| CVE-2023-48311 | DO dockerspawner jupyterhub | 4.3 | Dec 8 | Any image allowed by default |
| CVE-2021-41194 | FU First Use Authenticator Jupyterhub | 9.8 | Oct 28 | FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub |
| CVE-2021-39160 | NB Nbgitpuller Jupyterhub | 8.8 | Aug 25 | nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path |
| CVE-2020-26261 | SY Systemdspawner Jupyterhub | 7.9 | Dec 9 | jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd |
| CVE-2020-15110 | KU Kubespawner Jupyterhub | 8.1 | Jul 17 | In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have… |