Packages you depend on that have known security holes (CVEs).
-
Serious CVE-2019-12855 python-twisted: XMPP support in words.protocols.jabber.xmlstream in Twisted does not verify certificates allowing for a MITM connections
notebook-diagnostic/requirements.txt
A package you depend on has a known security hole (CVE-2019-12855). Fix: Update that package to its patched version.
-
Serious CVE-2020-10108 python-twisted: HTTP request smuggling when presented with two Content-Length headers
notebook-diagnostic/requirements.txt
A package you depend on has a known security hole (CVE-2020-10108). Fix: Update that package to its patched version.
-
Serious CVE-2020-10109 python-twisted: HTTP request smuggling when presented with a Content-Length and a chunked Transfer-Encoding header
notebook-diagnostic/requirements.txt
A package you depend on has a known security hole (CVE-2020-10109). Fix: Update that package to its patched version.
-
Serious CVE-2022-24801 python-twisted: possible http request smuggling
notebook-diagnostic/requirements.txt
A package you depend on has a known security hole (CVE-2022-24801). Fix: Update that package to its patched version.
-
Serious GHSA-32gv-6cf3-wcmq HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
notebook-diagnostic/requirements.txt
A package you depend on has a known security hole (GHSA-32gv-6cf3-wcmq). Fix: Update that package to its patched version.
-
Serious CVE-2019-6446 numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution
py3test/requirements.txt
A package you depend on has a known security hole (CVE-2019-6446). Fix: Update that package to its patched version.
-
Worth fixing CVE-2020-28493 python-jinja2: ReDoS vulnerability in the urlize filter
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
-
Worth fixing CVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
-
Worth fixing CVE-2024-34064 jinja2: accepts keys containing non-attribute characters
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
-
Worth fixing CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
-
Worth fixing CVE-2025-27516 jinja2: Jinja sandbox breakout through attr filter selecting format method
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
-
Worth fixing CVE-2021-20270 python-pygments: Infinite loop in SML lexer may lead to DoS
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2021-20270). Fix: Update that package to its patched version.
-
Worth fixing CVE-2021-27291 python-pygments: ReDoS in multiple lexers
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2021-27291). Fix: Update that package to its patched version.
-
Worth fixing CVE-2022-40896 pygments: ReDoS in pygments
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2022-40896). Fix: Update that package to its patched version.
-
Worth fixing CVE-2020-6817 bleach.clean behavior parsing style attributes could result in a regul ...
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2020-6817). Fix: Update that package to its patched version.
-
Worth fixing CVE-2020-6802 In Mozilla Bleach before 3.11, a mutation XSS affects users calling bl ...
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2020-6802). Fix: Update that package to its patched version.
-
Worth fixing CVE-2020-6816 In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCD ...
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2020-6816). Fix: Update that package to its patched version.
-
Worth fixing CVE-2021-23980 python-bleach: Mutation cross-site scripting in bleach.clean
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2021-23980). Fix: Update that package to its patched version.
-
Worth fixing GHSA-gj48-438w-jh9v Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (GHSA-gj48-438w-jh9v). Fix: Update that package to its patched version.
-
Worth fixing CVE-2023-37920 python-certifi: Removal of e-Tugra root certificate
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2023-37920). Fix: Update that package to its patched version.
-
Worth fixing CVE-2022-23491 python-certifi: untrusted root certificates
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2022-23491). Fix: Update that package to its patched version.
-
Worth fixing CVE-2024-3651 python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2024-3651). Fix: Update that package to its patched version.
-
Worth fixing CVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputs
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
-
Worth fixing CVE-2022-21699 IPython (Interactive Python) is a command shell for interactive comput ...
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2022-21699). Fix: Update that package to its patched version.
-
Worth fixing CVE-2022-39286 Jupyter Core is a package for the core common functionality of Jupyter ...
jupyter-requirements/requirements.txt
A package you depend on has a known security hole (CVE-2022-39286). Fix: Update that package to its patched version.