459 matches found
CVE-2026-40864
CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version posting to a different origin — precisely the classic CSRF vector the token is supposed to...
UBUNTU-CVE-2026-108752
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...
Linux Distros Unpatched Vulnerability : CVE-2026-108752
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by...
DEBIAN-CVE-2026-108752
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...
CVE-2026-108752
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...
EUVD-2026-96917
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...
CVE-2026-108752
JupyterHub versions through 6.0.1 are vulnerable to an identifier collision vulnerability caused by the use of unescaped hyphens in usernames. This flaw allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username (e.g., a user with the nam...
CVE-2026-108752
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...
CVE-2026-108752
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...
CVE-2026-108752 JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...
CVE-2026-108752 JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...
PT-2026-110154
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...
CLEANSTART-2026-TZ94047 Tornado is a Python web framework and asynchronous networking library
Security vulnerability affects the jupyterhub-k8s-hub package. Tornado is a Python web framework and asynchronous networking library...
CVE-2026-102831 vulnerabilities
Vulnerabilities for packages: jupyterhub-k8s-singleuser-sample...
CVE-2026-102904 vulnerabilities
Vulnerabilities for packages: jupyterhub-k8s-singleuser-sample...
CVE-2026-102830 vulnerabilities
Vulnerabilities for packages: jupyterhub-k8s-singleuser-sample...
GHSA-3325-V43H-43RV vulnerabilities
Vulnerabilities for packages: jupyterhub-k8s-singleuser-sample...
GHSA-3JQQ-PW4J-PQCJ vulnerabilities
Vulnerabilities for packages: jupyterhub-k8s-singleuser-sample...