CVE Watch16 de out. de 2026

CVE-2026-102832

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 u

CVSS

4.2

Média

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 13 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-367 · CWE-863

EPSS · 30d

0.1%EPSS · 30 dias0.1%

2026-10-142026-11-06

Descrição técnica

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or notebook when the user answers rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a prompt, and trusting a notebook marks all cells trusted, saves unsaved edits, and persists the server signature to disk. Applications that bundle JupyterLab, including affected Notebook and JupyterLite releases, inherit the behavior. This issue is fixed in versions 4.5.11 and 4.6.4.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-634405.9 MÉD

—

———2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0.7h CVE-2026-1240264.3 MÉD

—

——0Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar.8h CVE-2026-857445.4 MÉD

—

——0FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in response['msg'] and then clears that value inside the source-conversation loop. An authenticated agent can merge a conversation they control into a target conversation in a mailbox they cannot access. The operation injects threads, attachments, and audit records into the unauthorized target and deletes the source conversation, but it does not disclose the target's existing contents. This issue is fixed in version 1.8.227.11h CVE-2026-1238527.4 ALT

—

——0In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates8h CVE-2026-1238355.9 MÉD

—

——0In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition8h CVE-2026-1234865.3 MÉD

—

——0WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.13h