CVE-2026-23949 vulnerabilities

Vulnerabilities for packages: azure-functions-python-worker, label-studio, kubeflow-katib, py3-cassandra-medusa, awx, pypy-3.11, kubeflow-jupyter-web-app, tensorflow-gpu-jupyter, tritonserver-backend-vllm-cuda-12.9, pypy-3.10, opal, ansible-operator, spamcheck, nemo, py3.9-setuptools,...

GHSA-58PV-8J8X-9VJ2 vulnerabilities

Vulnerabilities for packages: open-webui, kserve, datadog-agent, py3-setuptools, pypy-3.10, airflow, emissary, pypy-3.11, superset, py3-cassandra-medusa, kubeflow-katib, dask-kubernetes, mlflow, kubeflow-jupyter-web-app, semgrep...

CVE-2026-23528 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, dask-gateway...

GHSA-C336-7962-WFJ2 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, dask-gateway...

GHSA-C336-7962-WFJ2 vulnerabilities

Vulnerabilities for packages: dask-gateway, dask-kubernetes...

GHSA-58PV-8J8X-9VJ2 vulnerabilities

Vulnerabilities for packages: azure-functions-python-worker, label-studio, kubeflow-katib, py3-cassandra-medusa, awx, pypy-3.11, kubeflow-jupyter-web-app, tensorflow-gpu-jupyter, tritonserver-backend-vllm-cuda-12.9, pypy-3.10, opal, ansible-operator, spamcheck, nemo, py3.9-setuptools,...

CVE-2026-23528 vulnerabilities

Vulnerabilities for packages: dask-gateway, dask-kubernetes...

CVE-2026-23528

Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together, it is possible to craft a URL which will result in code being executed by Jupyter due to a cross-side-scripting XSS bug in the Dask...

Linux Distros Unpatched Vulnerability : CVE-2026-23528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter- server-proxy, and Dask distributed are all run together...

Cross-site Scripting (XSS)

Overview distributed is a Distributed scheduler for Dask Affected versions of this package are vulnerable to Cross-site Scripting XSS via the interaction between Jupyter Lab, jupyter-server-proxy, and the Dask dashboard. An attacker can execute arbitrary code by enticing a user to click a phishin...

dask-sql (2024.1.0rc0), fvgp (>=4.1.2, <=4.2.9) +5 more potentially affected by CVE-2026-23528 via distributed (2024.1.0)

distributed PYPI version 2024.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-sql 2024.1.0rc0 - fvgp =4.1.2, =8.0.3, =0.1.4, =0.2.0a6, =0.1.2, =0.1.3 Source cves: CVE-2026-23528 Source advisory:...

dask-sql (>=2023.10.0, <=2023.10.1), mlrun (>=1.6.0rc1, <=1.6.0rc2) +1 more potentially affected by CVE-2026-23528 via distributed (2023.9.3)

distributed PYPI version 2023.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-sql =2023.10.0, =1.6.0rc1, =1.6.0rc2 - wisio 0.0.2 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

PYSEC-2026-169

Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, and Dask distributed are all run together, it is possible to craft a URL which will result in code being executed by Jupyter due to a cross-side-scripting XSS bug in the Dask...

prefect-dask (0.2.4) potentially affected by CVE-2026-23528 via distributed (2023.3.1)

distributed PYPI version 2023.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - prefect-dask 0.2.4 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

cimla (>=0.0.8, <=0.0.18), dask-sql (2021.11.0) +3 more potentially affected by CVE-2026-23528 via distributed (2021.10.0)

distributed PYPI version 2021.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - cimla =0.0.8, =21.11.0b1, =0.1.0, =0.3.7, =0.3.9 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

auto-ts (0.0.63), dask-cuda (>=22.2.0a220125, <=22.4.0a220201) +3 more potentially affected by CVE-2026-23528 via distributed (2022.1.0)

distributed PYPI version 2022.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - auto-ts 0.0.63 - dask-cuda =22.2.0a220125, =22.4.0a220201 - dask-sql 2022.1.0 - sgkit 0.5.0 - sphynxml 2.0.0 Source cves: CVE-2026-2352...

checkatlas (>=0.0.1, <=0.1.2), dask-cuda (>=22.4.0a220323, <=22.6.0a220408) potentially affected by CVE-2026-23528 via distributed (2022.3.0)

distributed PYPI version 2022.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - checkatlas =0.0.1, =22.4.0a220323, =22.6.0a220408 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

dask-janelia (0.1.2), fibsem-tools (>=0.1.3, <=0.1.4) potentially affected by CVE-2026-23528 via distributed (2020.12.0)

distributed PYPI version 2020.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-janelia 0.1.2 - fibsem-tools =0.1.3, =0.1.4 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

dask-sql (2022.8.0), simmate (>=0.8.0, <=0.11.1) potentially affected by CVE-2026-23528 via distributed (2022.8.0)

distributed PYPI version 2022.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-sql 2022.8.0 - simmate =0.8.0, =0.11.1 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

dask-cuda (>=23.4.0a230405, <=23.8.0a230605), dask-sql (2023.4.0) +5 more potentially affected by CVE-2026-23528 via distributed (2023.3.2.1)

distributed PYPI version 2023.3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-cuda =23.4.0a230405, =0.0.1, =3.0.40, =3.1.3 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...