Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

rucio-webui

6 known vulnerabilities (2 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
41.5.1 (Oct 21, 2026): no advisory affects it
Newest unaffected release
41.5.1 (Oct 21, 2026), the latest release
Advisories
6 · 2 high, 4 medium
Weekly downloads
68
Dependents
0
Releases
492 since 1.5.10 (May 10, 2016)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-25736
    Affects 1.5.10 to 35.8.2 (35.8.3 is outside it); 36.0.0rc1 to 38.5.3 (38.5.4 is outside it); 39.0.0rc1 to 39.3.0 (39.3.1 is outside it)
  • CVE-2026-25735
    Affects 1.5.10 to 35.8.2 (35.8.3 is outside it); 36.0.0rc1 to 38.5.3 (38.5.4 is outside it); 39.0.0rc1 to 39.3.0 (39.3.1 is outside it)
  • CVE-2026-25734
    Affects 1.5.10 to 35.8.2 (35.8.3 is outside it); 36.0.0rc1 to 38.5.3 (38.5.4 is outside it); 39.0.0rc1 to 39.3.0 (39.3.1 is outside it)
  • CVE-2026-25733
    Affects 1.5.10 to 35.8.2 (35.8.3 is outside it); 36.0.0rc1 to 38.5.3 (38.5.4 is outside it); 39.0.0rc1 to 39.3.0 (39.3.1 is outside it)
  • CVE-2026-25138
    Affects 1.5.10 to 35.8.2 (35.8.3 is outside it); 36.0.0rc1 to 38.5.3 (38.5.4 is outside it); 39.0.0rc1 to 39.3.0 (39.3.1 is outside it)
  • CVE-2026-25136
    Affects 1.5.10 to 35.8.2 (35.8.3 is outside it); 36.0.0rc1 to 38.5.3 (38.5.4 is outside it); 39.0.0rc1 to 39.3.0 (39.3.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • CVE-2026-25736Medium 6.1

    Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute

    Affected: fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1; fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1.

    Fixed in 35.8.3 (released Feb 25, 2026, the day of disclosure), 38.5.4 (released Feb 25, 2026, the day of disclosure) and 39.3.1 (released Feb 25, 2026, the day of disclosure).

    The latest release, 41.5.1, is not affected.

  • CVE-2026-25735Medium 6.1

    Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name

    Affected: fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1; fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1.

    Fixed in 35.8.3 (released Feb 25, 2026, the day of disclosure), 38.5.4 (released Feb 25, 2026, the day of disclosure) and 39.3.1 (released Feb 25, 2026, the day of disclosure).

    The latest release, 41.5.1, is not affected.

  • CVE-2026-25734Medium 6.1

    Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

    Affected: fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1; fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1.

    Fixed in 35.8.3 (released Feb 25, 2026, the day of disclosure), 38.5.4 (released Feb 25, 2026, the day of disclosure) and 39.3.1 (released Feb 25, 2026, the day of disclosure).

    The latest release, 41.5.1, is not affected.

  • Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function

    Affected: fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1; fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1.

    Fixed in 35.8.3 (released Feb 25, 2026, the day of disclosure), 38.5.4 (released Feb 25, 2026, the day of disclosure) and 39.3.1 (released Feb 25, 2026, the day of disclosure).

    The latest release, 41.5.1, is not affected.

  • CVE-2026-25138Medium 5.3

    Rucio WebUI has Username Enumeration via Login Error Message

    Affected: fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1; fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1.

    Fixed in 35.8.3 (released Feb 25, 2026, the day of disclosure), 38.5.4 (released Feb 25, 2026, the day of disclosure) and 39.3.1 (released Feb 25, 2026, the day of disclosure).

    The latest release, 41.5.1, is not affected.

  • Rucio WebUI has a Reflected Cross-site Scripting Vulnerability

    Affected: fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1; fixed in 35.8.3; from 36.0.0rc1, fixed in 38.5.4; from 39.0.0rc1, fixed in 39.3.1.

    Fixed in 35.8.3 (released Feb 25, 2026, the day of disclosure), 38.5.4 (released Feb 25, 2026, the day of disclosure) and 39.3.1 (released Feb 25, 2026, the day of disclosure).

    The latest release, 41.5.1, is not affected.