https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T12:34:22.636861+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-32428 CVE-2025-32428 — Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended 2026-10-07T12:34:22.638668+00:00

Affected: jupyterhub jupyter-remote-desktop-proxy

Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network. This vulnerability does not affect users having TurboVNC as the vncserver executable. This issue is fixed in 3.0.1.

 https://cve.radiocsirt.org/vuln/ghsa-vrq4-9hc3-cgp7 GHSA-vrq4-9hc3-cgp7 — TigerVNC accessible via the network and not just via a UNIX socket as intended 2026-10-07T12:34:22.638722+00:00

Affected: PyPI: jupyter-remote-desktop-proxy

## Summary

`jupyter-remote-desktop-proxy` was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by `jupyter-remote-desktop-proxy` were still accessible via the network.

This vulnerability does not affect users having TurboVNC as the `vncserver` executable.

## Credits

This vulnerability was identified by Arne Gottwald at University of Göttingen and analyzed, reported, and reviewed by @frejanordsiek.