Login Request a demo
JU
Product
jupyterlab
by jupyterlab · last CVE Oct 13, 2026
14
CVEs
0
On KEV
9.6
Max CVSS
4
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 1High 6Medium 7Low 0
Severity
All severities14Critical1High6Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add jupyterlab to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-42266
8.8
6%
May 13
JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.
Affected: >= 4.0.0, < 4.5.7
CVE-2026-73417
8.6
1%
Aug 13
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
Affected: >= 3.3.0, < 4.5.10; >= 4.6.0, < 4.6.2
CVE-2026-40171
8.4
0%
May 6
Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker
Affected: <= 4.5.6
CVE-2026-102831
8.1
0%
Sep 29
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
Affected: >= 4.5.0, < 4.5.11; >= 4.6.0, < 4.6.4
CVE-2026-73626
7.5
0%
Aug 13
JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager
Affected: 4.6.0 before 4.6.1; before 4.5.10
CVE-2026-73415
7.5
1%
Aug 12
jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
Affected: < 4.5.10; >= 4.6.0, < 4.6.2
Showing 6