Login Request a demo
JU
Product
jupyter_server
by jupyter-server · last CVE Oct 21, 2026
7
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 0High 4Medium 3Low 0
Severity
All severities7Critical0High4Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add jupyter_server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-114135
New
8.8
0%
Oct 21
Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
Affected: >= 2.0.0, < 2.6.0
CVE-2026-35397
8.8
1%
May 5
jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix
Affected: < 2.18.0
CVE-2026-40110
7.3
0%
May 5
jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat
Affected: <= 2.17.0
CVE-2026-86049
7.1
0%
Sep 17
Jupyter Server: 5xx request logging leaks token-bearing Referer header values
Affected: < 2.21.0
CVE-2026-40934
6.8
0%
May 5
jupyter-server authentication cookies remain valid after password reset due to static cookie secret
Affected: < 2.18.0
CVE-2025-61669
6.1
0%
May 5
jupyter_server next parameter open redirect can redirect users to external domains
Affected: <= 2.17.0
CVE-2026-44727
5.4
0%
Jun 22
Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
Affected: < 2.20
Showing 7