CVE-2023-39531

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. Th...

Account Takeover

Sentry is vulnerable to Account Takeover. The vulnerability is due to improper handling of SAML Identity Providers, which allows an attacker to craft a malicious SAML response and associate it with a different organization on the same Sentry instance...

Sentry's improper authentication on SAML SSO process allows user impersonation

Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication through the SAML SSO implementation process which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Note: This is...

CVE-2025-22146

Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a...

CVE-2025-22146 Improper authentication on SAML SSO process allows user impersonation in sentry

Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a...

CVE-2025-22146

CVE-2025-22146 affects Sentry’s SAML SSO implementation. The vulnerability allows an attacker to impersonate users and take over accounts on the same Sentry instance by leveraging a malicious SAML Identity Provider, with the victim’s email known to exploit it. The SaaS fix was deployed on 2025-01...

CVE-2024-53253 Sentry's improper error handling leaks Application Integration Client Secret

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

CVE-2024-48743

Cross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parameter...

Authorization Bypass

Sentry is vulnerable to Authorization Bypass. The vulnerability is due to improper scoping of authorization checks on requests to mute alert rules, which allows authenticated users to mute alerts without being members of the organization or having the required permissions on the project...

Sentry 安全漏洞

Sentry is a developer-oriented bug tracking and performance monitoring platform from Sentry Open Source. A security vulnerability exists in Sentry versions 23.9.0 and earlier and 24.8.0 and earlier, which stems from an authenticated user being able to remove alert notifications from any user with...

1a23-telemetry (=1.0.0), aioshadowsocks (=0.1.8) +176 more potentially affected by CVE-2024-40647 via sentry-sdk (>=0.20.0 <=1.45.0)

sentry-sdk PYPI version =0.20.0, =0.0.1, =0.2.8, =0.1.0, =0.0.1.dev48, =0.0.1, =1.1.0, =1.1.0, =0.0.3, =0.1.2, =3.0.1, =1.0.1, =0.9.0, =0.10.0rc1 and more Source cves: CVE-2024-40647 Source advisory: OSV:GHSA-G92J-QHMH-64V2...

WordPress Sentry plugin <= 7.8.0 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Sentry versions = 7.8.0...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-38035 Ivanti Sentry Authentication Bypass Vulnerability CVE-2023-27532 Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function...

cbs-sentry-dingding (=1.0.24), cbs-sentry-qyweixin (=1.0.1) +47 more potentially affected by CVE-2023-39531 via sentry (=20.8.0)

sentry PYPI version =20.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentry and may be impacted: - cbs-sentry-dingding =1.0.24 - cbs-sentry-qyweixin =1.0.1 - csnp =0.0.5, =1.0.0, =0.2.4, =1.0.0, =0.1.0, =0.4.0, =0.1.0, =0.2.0 and more Source cve...

1a23-telemetry (=1.0.0), aioshadowsocks (=0.1.8) +56 more potentially affected by CVE-2023-28117 via sentry-sdk (>=0.20.0 <=1.13.0)

sentry-sdk PYPI version =0.20.0, =0.2.8, =0.0.1.dev48, =1.6.2, =0.1.4.7, =1.3.0.dev599, =0.26.1, =1.4.0, =1.0.51, =18.10.4.0, =18.11.3.0 - ev3sim =2.2.3 and more Source cves: CVE-2023-28117 Source advisory: OSV:GHSA-29PR-6JR8-Q5JM...

SUSE CVE-2022-23485

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...

cbs-sentry-dingding (=1.0.24), cbs-sentry-qyweixin (=1.0.1) +47 more potentially affected by CVE-2022-23485 via sentry (=20.8.0)

sentry PYPI version =20.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentry and may be impacted: - cbs-sentry-dingding =1.0.24 - cbs-sentry-qyweixin =1.0.1 - csnp =0.0.5, =1.0.0, =0.2.4, =1.0.0, =0.1.0, =0.4.0, =0.1.0, =0.2.0 and more Source cve...

CVE-2022-23485 Invite code reuse via cookie manipulation in sentry

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...

CVE-2020-15505

A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database RDB version 2.0.0.1 and earlier that...