JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

fast-uri vulnerable to host confusion via failed IDN canonicalization

Python-Multipart: Denial of Service via unbounded multipart part headers

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Quadratic string concatentation in consumeComment in net/mail

Quadratic string concatenation in consumePhrase in net/mail

Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

AIOHTTP Vulnerable to Deserialization of Untrusted Data

jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat