What’s Vulnerable › Products

jupyter-server jupyter_server vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your jupyter-server jupyter_server version is affected

Latest jupyter-server jupyter_server vulnerabilities

• CVE-2026-114135 — Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization (CVSS 8.8)
• CVE-2026-86049 — Jupyter Server: 5xx request logging leaks token-bearing Referer header values (CVSS 7.1)
• CVE-2026-44727 — Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP (CVSS 5.4)
• CVE-2026-6657 — CORS Origin Validation Bypass in jupyter-server (CVSS 8.8)
• CVE-2026-5422 — Path Traversal in jupyter/jupyter (CVSS 8.1)
• CVE-2026-40934 — jupyter-server authentication cookies remain valid after password reset due to static cookie secret (CVSS 6.8)
• CVE-2026-40110 — jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat (CVSS 7.3)
• CVE-2026-35397 — jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix (CVSS 8.8)
• CVE-2025-61669 — jupyter_server next parameter open redirect can redirect users to external domains (CVSS 6.1)
• CVE-2024-35178 — Jupyter server on Windows discloses Windows user password hash (CVSS 7.5)
• CVE-2023-49080 — Jupyter Server errors include tracebacks with path information (CVSS 4.3)
• CVE-2023-40170 — cross-site inclusion (XSSI) of files in jupyter-server (CVSS 6.1)
• CVE-2023-39968 — Open Redirect Vulnerability in jupyter-server (CVSS 6.1)
• CVE-2022-29241 — Known or guessable hidden files may be accessed in Jupyter Server (CVSS 8.8)
• CVE-2022-24757 — Sensitive Auth & Cookie data stored in Jupyter server logs (CVSS 7.5)
• CVE-2020-26275 — Open redirect vulnerability (CVSS 6.1)
• CVE-2020-26232 — Open redirect in Jupyter Server (CVSS 5.4)