Login Request a demo
JU
Product
jupyterhub
by jupyterhub · last CVE Oct 11, 2026
6
CVEs
0
On KEV
7.2
Max CVSS
1
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 0High 1Medium 5Low 0
Severity
All severities6Critical0High1Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add jupyterhub to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-33709
6.1
0%
Apr 3
JupyterHub has an Open Redirect Vulnerability
Affected: < 5.4.4
CVE-2024-28233
6.1
0%
Mar 27
XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing
Affected: < 4.1.0
CVE-2026-54338
5.3
0%
Aug 7
JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Affected: < 5.5.0JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
CVE-2026-40864
4.3
0%
May 22
JupyterHub: Cross-origin form POSTs bypass XSRF
Affected: >= 4.1.0, < 5.4.5
CVE-2026-108752
4.2
0%
Oct 11
JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
Affected: through 6.0.1
Showing 5