Product by Jupyter
Jupyter Server
15 known vulnerabilities in Jupyter Server (Jupyter), 0 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-5422 | Path Traversal in jupyter/jupyter | 6.8 | |
| High | CVE-2026-6657 | CORS Origin Validation Bypass in jupyter-server | 6.1 | |
| High | CVE-2026-35397 | jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix | 8.8 | |
| Critical | CVE-2026-44727 | Jupyter Server: Cross-site Scripting | 5.4 | |
| High | CVE-2022-24757 | Sensitive Auth & Cookie data stored in Jupyter server logs | 7.5 | |
| Medium | CVE-2020-26275 | Open redirect vulnerability | 6.1 | |
| High | CVE-2024-35178 | Jupyter server on Windows discloses Windows user password hash | 7.5 | |
| High | CVE-2022-29241 | Known or guessable hidden files may be accessed in Jupyter Server | 7.1 | |
| High | CVE-2026-40934 | jupyter-server authentication cookies remain valid after password reset due to static cookie secret | 6.8 | |
| High | CVE-2026-40110 | jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat | 7.3 | |
| Medium | CVE-2020-26232 | Open redirect in Jupyter Server | 4.1 | |
| Medium | CVE-2025-61669 | jupyter_server next parameter open redirect can redirect users to external domains | 6.1 | |
| Medium | CVE-2023-49080 | Jupyter Server errors include tracebacks with path information | 3.5 | |
| Medium | CVE-2023-39968 | Open Redirect Vulnerability in jupyter-server | 4.3 | |
| Medium | CVE-2023-40170 | cross-site inclusion (XSSI) of files in jupyter-server | 4.6 |