JupyterHub — CVE history (PyPI)
JupyterHub
9 CVEs affect the JupyterHub PyPI package (highest CVSS 8.1). Latest disclosed: 2026-10-11. Full CVE history sourced from NVD.
Summary
- Package
JupyterHub(PyPI)- Total CVEs
9- Actively exploited (CISA KEV)
- 0
- Highest CVSS
8.1- Latest disclosed
- 2026-10-11
Recent CVEs (top 9)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-108752 | Medium | 4.2 | — | 2026-10-11 | JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. |
CVE-2026-54338 | Medium | 5.3 | — | 2026-08-07 | JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. |
CVE-2026-40864 | Medium | 5.4 | — | 2026-05-22 | JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. |
CVE-2026-33709 | Medium | 6.1 | — | 2026-04-03 | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. |
CVE-2024-41942 | High | 7.2 | — | 2024-08-08 | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. |
CVE-2024-28233 | High | 8.1 | — | 2024-03-27 | JupyterHub is an open source multi-user server for Jupyter notebooks. |
CVE-2021-41247 | Low | 3.5 | — | 2021-11-04 | JupyterHub is an open source multi-user server for Jupyter notebooks. |
CVE-2020-36191 | Medium | 4.5 | — | 2021-01-13 | JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account). |
CVE-2019-10255 | Medium | 6.1 | — | 2019-03-28 | An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successfu… |
All-time worst (top 9 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2024-28233 | High | 8.1 | — | 2024-03-27 | JupyterHub is an open source multi-user server for Jupyter notebooks. |
CVE-2024-41942 | High | 7.2 | — | 2024-08-08 | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. |
CVE-2026-33709 | Medium | 6.1 | — | 2026-04-03 | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. |
CVE-2019-10255 | Medium | 6.1 | — | 2019-03-28 | An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successfu… |
CVE-2026-40864 | Medium | 5.4 | — | 2026-05-22 | JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. |
CVE-2026-54338 | Medium | 5.3 | — | 2026-08-07 | JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. |
CVE-2020-36191 | Medium | 4.5 | — | 2021-01-13 | JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account). |
CVE-2026-108752 | Medium | 4.2 | — | 2026-10-11 | JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. |
CVE-2021-41247 | Low | 3.5 | — | 2021-11-04 | JupyterHub is an open source multi-user server for Jupyter notebooks. |