https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 20:59:58 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-06495 bdu:2025-06495 https://cve.radiocsirt.org/vuln/bdu:2025-06495 https://cve.radiocsirt.org/vuln/brew-jupyterlab-cve-2025-30167 <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>## Impact</p> <p>On Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.</p> <p>Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.</p> <p>## Mitigations</p> <p>- upgrade to `jupyter_core&gt;=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or - as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or - as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions, or - as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)</p> <p>## Credit</p> <p>Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932</p> <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>## Impact</p> <p>On Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.</p> <p>Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.</p> <p>## Mitigations</p> <p>- upgrade to `jupyter_core&gt;=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or - as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or - as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions, or - as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)</p> <p>## Credit</p> <p>Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932</p> https://cve.radiocsirt.org/vuln/brew-jupyterlab-cve-2025-30167 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0606 certfr-2026-avi-0606 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0606 https://cve.radiocsirt.org/vuln/euvd-2026-266425 EUVD-2026-266425 https://cve.radiocsirt.org/vuln/euvd-2026-266425 https://cve.radiocsirt.org/vuln/fkie_cve-2025-30167 <p>Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).</p> <p>Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-30167 https://cve.radiocsirt.org/vuln/ghsa-33p9-3p43-82vq <p><strong>Affected:</strong> PyPI: jupyter_core</p> <p>## Impact</p> <p>On Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.</p> <p>Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.</p> <p>## Mitigations</p> <p>- upgrade to `jupyter_core&gt;=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or - as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or - as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions, or - as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)</p> <p>## Credit</p> <p>Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932</p> <p><strong>Affected:</strong> PyPI: jupyter_core</p> <p>## Impact</p> <p>On Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.</p> <p>Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.</p> <p>## Mitigations</p> <p>- upgrade to `jupyter_core&gt;=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or - as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or - as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions, or - as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)</p> <p>## Credit</p> <p>Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932</p> https://cve.radiocsirt.org/vuln/ghsa-33p9-3p43-82vq https://cve.radiocsirt.org/vuln/opensuse-su-2025:15272-1 <p>python311-jupyter-core-5.8.1-1.1 on GA media</p> <p>python311-jupyter-core-5.8.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15272-1 https://cve.radiocsirt.org/vuln/pysec-2026-1477 <p><strong>Affected:</strong> PyPI: jupyter-core</p> <p>## Impact</p> <p>On Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.</p> <p>Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.</p> <p>## Mitigations</p> <p>- upgrade to `jupyter_core&gt;=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or - as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or - as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions, or - as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)</p> <p>## Credit</p> <p>Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932</p> <p><strong>Affected:</strong> PyPI: jupyter-core</p> <p>## Impact</p> <p>On Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.</p> <p>Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.</p> <p>## Mitigations</p> <p>- upgrade to `jupyter_core&gt;=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or - as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or - as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions, or - as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)</p> <p>## Credit</p> <p>Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932</p> https://cve.radiocsirt.org/vuln/pysec-2026-1477 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-30167 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: jupyter-core, Ubuntu:Pro:20.04:LTS: jupyter-core, Ubuntu:Pro:22.04:LTS: jupyter-core, Ubuntu:24.04:LTS: jupyter-core, Ubuntu:25.10: jupyter-core, Ubuntu:26.04:LTS: jupyter-core</p> <p>Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: jupyter-core, Ubuntu:Pro:20.04:LTS: jupyter-core, Ubuntu:Pro:22.04:LTS: jupyter-core, Ubuntu:24.04:LTS: jupyter-core, Ubuntu:25.10: jupyter-core, Ubuntu:26.04:LTS: jupyter-core</p> <p>Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-30167