PyPIPackage

ethyca-fides

22 known vulnerabilities (1 critical, 6 high, 7 medium, 7 low), with the versions each affects and the releases that fix them.

Latest release: 2.86.2 (Jun 1, 2026): no advisory affects it
Newest unaffected release: 2.86.2 (Jun 1, 2026), the latest release
Advisories: 22 · 1 critical, 6 high, 7 medium, 7 low

Weekly downloads: 2,057
Dependents: 0
Releases: 500+ since 2.57.0 (Mar 17, 2025)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-44541
Affects 2.57.0 to 2.84.5rc0 (2.84.5 is outside it)
CVE-2026-42303
Affects 2.75.0 to 2.83.2rc3 (2.83.2 is outside it)
CVE-2025-57817
Affects 2.57.0 to 2.69.1rc1 (2.69.1 is outside it)
CVE-2025-57816
Affects 2.57.0 to 2.69.1rc1 (2.69.1 is outside it)
CVE-2025-57766
Affects 2.57.0 to 2.69.1rc1 (2.69.1 is outside it)
CVE-2025-57815
Affects 2.57.0 to 2.69.1rc1 (2.69.1 is outside it)
CVE-2024-52008
No published release is affected
No published release is affected
CVE-2024-45053
No published release is affected
No published release is affected
CVE-2024-45052
No published release is affected
No published release is affected
CVE-2024-31223
No published release is affected
No published release is affected
CVE-2024-38537
No published release is affected
No published release is affected
CVE-2024-35189
No published release is affected
No published release is affected

Show all 22 advisoriesShow fewer advisories

CVE-2024-34715
No published release is affected
No published release is affected
CVE-2023-48224
No published release is affected
No published release is affected
CVE-2023-47114
No published release is affected
No published release is affected
CVE-2023-46124
No published release is affected
No published release is affected
CVE-2023-46125
No published release is affected
No published release is affected
CVE-2023-46126
No published release is affected
No published release is affected
CVE-2023-41319
No published release is affected
No published release is affected
CVE-2023-37480
No published release is affected
No published release is affected
CVE-2023-37481
No published release is affected
No published release is affected
CVE-2023-36827
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 22

CVE-2026-44541High 7.0
Fides: DOM-based XSS vulnerability in fides.js via fides_description override
Affected: from 2.33.0, fixed in 2.84.5.
Fixed in 2.84.5 (released May 7, 2026, 32 days before disclosure).
The latest release, 2.86.2, is not affected.
CVE-2026-42303Medium 6.1
Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection
Affected: from 2.75.0, fixed in 2.83.2.
Fixed in 2.83.2 (released Apr 21, 2026, 21 days before disclosure).
The latest release, 2.86.2, is not affected.
CVE-2025-57817High 8.6
Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation
Affected: fixed in 2.69.1.
Fixed in 2.69.1 (released Sep 3, 2025, 5 days before disclosure).
The latest release, 2.86.2, is not affected.
CVE-2025-57816Medium 6.3
Fides Webserver API Rate Limiting Vulnerability in Proxied Environments
Affected: fixed in 2.69.1.
Fixed in 2.69.1 (released Sep 3, 2025, 5 days before disclosure).
The latest release, 2.86.2, is not affected.
CVE-2025-57766Low 1.7
Fides's Admin UI User Password Change Does Not Invalidate Current Session
Affected: fixed in 2.69.1.
Fixed in 2.69.1 (released Sep 3, 2025, 5 days before disclosure).
The latest release, 2.86.2, is not affected.
CVE-2025-57815Low 1.7
Fides Lacks Brute-Force Protections on Authentication Endpoints
Affected: fixed in 2.69.1.
Fixed in 2.69.1 (released Sep 3, 2025, 5 days before disclosure).
The latest release, 2.86.2, is not affected.
CVE-2024-52008Low 2.0
Password Policy Bypass Vulnerability in Fides Webserver
Affected: fixed in 2.50.0.
Fixed in 2.50.0.
The latest release, 2.86.2, is not affected.
CVE-2024-45053Critical 9.1
Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine
Affected: from 2.19.0, fixed in 2.44.0.
Fixed in 2.44.0.
The latest release, 2.86.2, is not affected.
CVE-2024-45052Medium 5.3
Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability
Affected: fixed in 2.44.0.
Fixed in 2.44.0.
The latest release, 2.86.2, is not affected.
CVE-2024-31223Medium 5.3
Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
Affected: from 2.19.0, fixed in 2.39.2.
Fixed in 2.39.2.
The latest release, 2.86.2, is not affected.
CVE-2024-38537None 0.0
Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js
Affected: fixed in 2.39.1.
Fixed in 2.39.1.
The latest release, 2.86.2, is not affected.
CVE-2024-35189Medium 6.5
Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides
Affected: fixed in 2.37.0.
Fixed in 2.37.0.
The latest release, 2.86.2, is not affected.
CVE-2024-34715Low 2.3
Partial Password Exposure Vulnerability in Fides Webserver Logs
Affected: fixed in 2.37.0.
Fixed in 2.37.0.
The latest release, 2.86.2, is not affected.
CVE-2023-48224High 8.2
Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides
Affected: fixed in 2.24.0.
Fixed in 2.24.0.
The latest release, 2.86.2, is not affected.
CVE-2023-47114Medium 4.3
Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages
Affected: from 2.15.1, fixed in 2.23.3.
Fixed in 2.23.3.
The latest release, 2.86.2, is not affected.

Show all 22 advisoriesShow fewer advisories

CVE-2023-46124High 8.2
Server-Side Request Forgery Vulnerability in Custom Integration Upload
Affected: fixed in 2.22.1.
Fixed in 2.22.1.
The latest release, 2.86.2, is not affected.
CVE-2023-46125Medium 6.5
Fides Information Disclosure Vulnerability in Config API Endpoint
Affected: fixed in 2.22.1.
Fixed in 2.22.1.
The latest release, 2.86.2, is not affected.
CVE-2023-46126Low 3.9
Fides JavaScript Injection Vulnerability in Privacy Center URL
Affected: fixed in 2.22.1.
Fixed in 2.22.1.
The latest release, 2.86.2, is not affected.
CVE-2023-41319High 8.8
Remote Code Execution in Custom Integration Upload in Fides
Affected: from 2.11.0, fixed in 2.19.0.
Fixed in 2.19.0.
The latest release, 2.86.2, is not affected.
CVE-2023-37480Low 2.7
Fides Webserver Vulnerable to Zip Bomb File Uploads
Affected: from 2.11.0, fixed in 2.16.0.
Fixed in 2.16.0.
The latest release, 2.86.2, is not affected.
CVE-2023-37481Low 2.7
Fides Webserver Vulnerable to SVG Bomb File Uploads
Affected: from 2.11.0, fixed in 2.16.0.
Fixed in 2.16.0.
The latest release, 2.86.2, is not affected.
CVE-2023-36827High 7.5
Fides vulnerable to Path Traversal in Webserver API
Affected: fixed in 2.15.1; fixed in 2.15.1.
Fixed in 2.15.1.
The latest release, 2.86.2, is not affected.