PyPIPackage

bugsink

10 known vulnerabilities (1 critical, 4 high, 3 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release: 2.6.3 (Nov 6, 2026): no advisory affects it
Newest unaffected release: 2.6.3 (Nov 6, 2026), the latest release
Advisories: 10 · 1 critical, 4 high, 3 medium, 2 low

Weekly downloads: 1,242
Dependents: 0
Releases: 71 since 0.0.1 (Feb 21, 2024)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-53954
Affects 0.0.1 to 2.2.1 (2.2.2 is outside it)
CVE-2026-47716
Affects 0.0.1 to 2.1.3 (2.2.0 is outside it)
CVE-2026-47715
Affects 0.0.1 to 2.1.3 (2.2.0 is outside it)
CVE-2026-47728
Affects 0.0.1 to 2.1.3 (2.2.0 is outside it)
CVE-2026-44502
Affects 0.0.1 to 2.1.2 (2.1.3 is outside it)
CVE-2026-40162
Affects 2.1.0 (2.1.1 is outside it)
CVE-2026-27614
Affects 0.0.1 to 2.0.12 (2.0.13 is outside it)
CVE-2025-64509
Affects 0.0.1 to 2.0.5 (2.0.6 is outside it)
CVE-2025-64508
Affects 0.0.1 to 2.0.4 (2.0.5 is outside it)
CVE-2025-54433
Affects 0.0.1 to 1.4.2 (1.4.3 is outside it); 1.5.0 to 1.5.4 (1.5.5 is outside it); 1.6.0 to 1.6.3 (1.6.4 is outside it); 1.7.0 to 1.7.3 (1.7.4 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

CVE-2026-53954Medium 4.3
Bugsink: DOS using large numbers of event tags
Affected: fixed in 2.2.2.
Fixed in 2.2.2 (released Jun 4, 2026, 103 days before disclosure).
The latest release, 2.6.3, is not affected.
CVE-2026-47716Low 3.1
Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
Affected: fixed in 2.2.0.
Fixed in 2.2.0 (released May 21, 2026, 5 days before disclosure).
The latest release, 2.6.3, is not affected.
CVE-2026-47715Low 3.1
Bugsink: Issue event views can show an event from another project if its UUID is known
Affected: fixed in 2.2.0.
Fixed in 2.2.0 (released May 21, 2026, 5 days before disclosure).
The latest release, 2.6.3, is not affected.
CVE-2026-47728Medium 4.3
Bugsink: Project scoping missing in sourcemap and debug-file lookup
Affected: fixed in 2.2.0.
Fixed in 2.2.0 (released May 21, 2026, 5 days before disclosure).
The latest release, 2.6.3, is not affected.
CVE-2026-44502Medium 4.3
Bugsink: SSRF bypass in `validate_webhook_url`
Affected: fixed in 2.1.3.
Fixed in 2.1.3 (released May 2, 2026, 24 days before disclosure).
The latest release, 2.6.3, is not affected.
CVE-2026-40162High 7.1
Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble
Affected: from 2.1.0, fixed in 2.1.1.
Fixed in 2.1.1 (released Apr 9, 2026, 1 day before disclosure).
The latest release, 2.6.3, is not affected.
CVE-2026-27614Critical 9.3
Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
Affected: fixed in 2.0.13.
Fixed in 2.0.13 (released Feb 21, 2026, 4 days before disclosure).
The latest release, 2.6.3, is not affected.
CVE-2025-64509High 7.5
Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)
Affected: fixed in 2.0.6.
Fixed in 2.0.6 (released Nov 8, 2025, 2 days before disclosure).
The latest release, 2.6.3, is not affected.
CVE-2025-64508High 7.5
Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input
Affected: fixed in 2.0.5.
Fixed in 2.0.5 (released Nov 8, 2025, 2 days before disclosure).
The latest release, 2.6.3, is not affected.
CVE-2025-54433High 7.2
Bugsink is vulnerable to Path Traversal attacks via event_id in ingestion
Affected: fixed in 1.4.3; from 1.5.0, fixed in 1.5.5; from 1.6.0, fixed in 1.6.4; from 1.7.0, fixed in 1.7.4; from 1.6.0, fixed in 1.6.4; from 1.7.0, fixed in 1.7.4; from 1.6.0, fixed in 1.6.4; from 1.5.0, fixed in 1.5.5; fixed in 1.4.3.
Fixed in 1.4.3 (released Jul 29, 2025, 1 day before disclosure), 1.5.5 (released Jul 29, 2025, 1 day before disclosure), 1.6.4 (released Jul 29, 2025, 1 day before disclosure) and 1 other version.
The latest release, 2.6.3, is not affected.