# bugsink (PyPI) vulnerabilities 10 known vulnerabilities (1 critical, 4 high, 3 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.6.3 (Nov 6, 2026): no advisory affects it - Newest unaffected release: 2.6.3 (Nov 6, 2026), the latest release - Weekly downloads: 1,242 - Dependents: 0 - Releases: 71 since 0.0.1 (Feb 21, 2024) - Registry: https://pypi.org/project/bugsink/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-53954: 0.0.1 to 2.2.1 (2.2.2 is outside it) - CVE-2026-47716: 0.0.1 to 2.1.3 (2.2.0 is outside it) - CVE-2026-47715: 0.0.1 to 2.1.3 (2.2.0 is outside it) - CVE-2026-47728: 0.0.1 to 2.1.3 (2.2.0 is outside it) - CVE-2026-44502: 0.0.1 to 2.1.2 (2.1.3 is outside it) - CVE-2026-40162: 2.1.0 (2.1.1 is outside it) - CVE-2026-27614: 0.0.1 to 2.0.12 (2.0.13 is outside it) - CVE-2025-64509: 0.0.1 to 2.0.5 (2.0.6 is outside it) - CVE-2025-64508: 0.0.1 to 2.0.4 (2.0.5 is outside it) - CVE-2025-54433: 0.0.1 to 1.4.2 (1.4.3 is outside it); 1.5.0 to 1.5.4 (1.5.5 is outside it); 1.6.0 to 1.6.3 (1.6.4 is outside it); 1.7.0 to 1.7.3 (1.7.4 is outside it) ## Advisories (10) ### [CVE-2026-53954](https://cve.now/CVE-2026-53954): Bugsink: DOS using large numbers of event tags - Severity: Medium 4.3 - Published: Sep 15, 2026 - Affected: fixed in 2.2.2. - Fixed in 2.2.2 (released Jun 4, 2026, 103 days before disclosure). - The latest release, 2.6.3, is not affected. ### [CVE-2026-47716](https://cve.now/CVE-2026-47716): Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known - Severity: Low 3.1 - Published: May 26, 2026 - Affected: fixed in 2.2.0. - Fixed in 2.2.0 (released May 21, 2026, 5 days before disclosure). - The latest release, 2.6.3, is not affected. ### [CVE-2026-47715](https://cve.now/CVE-2026-47715): Bugsink: Issue event views can show an event from another project if its UUID is known - Severity: Low 3.1 - Published: May 26, 2026 - Affected: fixed in 2.2.0. - Fixed in 2.2.0 (released May 21, 2026, 5 days before disclosure). - The latest release, 2.6.3, is not affected. ### [CVE-2026-47728](https://cve.now/CVE-2026-47728): Bugsink: Project scoping missing in sourcemap and debug-file lookup - Severity: Medium 4.3 - Published: May 26, 2026 - Affected: fixed in 2.2.0. - Fixed in 2.2.0 (released May 21, 2026, 5 days before disclosure). - The latest release, 2.6.3, is not affected. ### [CVE-2026-44502](https://cve.now/CVE-2026-44502): Bugsink: SSRF bypass in \`validate\_webhook\_url\` - Severity: Medium 4.3 - Published: May 26, 2026 - Affected: fixed in 2.1.3. - Fixed in 2.1.3 (released May 2, 2026, 24 days before disclosure). - The latest release, 2.6.3, is not affected. ### [CVE-2026-40162](https://cve.now/CVE-2026-40162): Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble - Severity: High 7.1 - Published: Apr 10, 2026 - Affected: from 2.1.0, fixed in 2.1.1. - Fixed in 2.1.1 (released Apr 9, 2026, 1 day before disclosure). - The latest release, 2.6.3, is not affected. ### [CVE-2026-27614](https://cve.now/CVE-2026-27614): Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering - Severity: Critical 9.3 - Published: Feb 25, 2026 - Affected: fixed in 2.0.13. - Fixed in 2.0.13 (released Feb 21, 2026, 4 days before disclosure). - The latest release, 2.6.3, is not affected. ### [CVE-2025-64509](https://cve.now/CVE-2025-64509): Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU) - Severity: High 7.5 - Published: Nov 10, 2025 - Affected: fixed in 2.0.6. - Fixed in 2.0.6 (released Nov 8, 2025, 2 days before disclosure). - The latest release, 2.6.3, is not affected. ### [CVE-2025-64508](https://cve.now/CVE-2025-64508): Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input - Severity: High 7.5 - Published: Nov 10, 2025 - Affected: fixed in 2.0.5. - Fixed in 2.0.5 (released Nov 8, 2025, 2 days before disclosure). - The latest release, 2.6.3, is not affected. ### [CVE-2025-54433](https://cve.now/CVE-2025-54433): Bugsink is vulnerable to Path Traversal attacks via event\_id in ingestion - Severity: High 7.2 - Published: Jul 30, 2025 - Affected: fixed in 1.4.3; from 1.5.0, fixed in 1.5.5; from 1.6.0, fixed in 1.6.4; from 1.7.0, fixed in 1.7.4; from 1.6.0, fixed in 1.6.4; from 1.7.0, fixed in 1.7.4; from 1.6.0, fixed in 1.6.4; from 1.5.0, fixed in 1.5.5; fixed in 1.4.3. - Fixed in 1.4.3 (released Jul 29, 2025, 1 day before disclosure), 1.5.5 (released Jul 29, 2025, 1 day before disclosure), 1.6.4 (released Jul 29, 2025, 1 day before disclosure) and 1 other version. - The latest release, 2.6.3, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/bugsink Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.