PyPIPackage

sentry

15 known vulnerabilities (3 critical, 6 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 23.7.1 (Jul 25, 2023): affected by 8 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 15 · 3 critical, 6 high, 5 medium, 1 low

Weekly downloads: 991
Dependents: 0
Releases: 371 since 2.0.0 (Jan 26, 2012)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2021-47935
Affects 2.0.0a1 to 8.2.1 (8.2.2 is outside it)
CVE-2026-42354
Affects 21.12.0 to 23.7.1 (through the newest release)
CVE-2026-27197
Affects 21.12.0 to 23.7.1 (through the newest release)
CVE-2025-22146
Affects 21.12.0 to 23.7.1 (through the newest release)
CVE-2024-53253
Affects 2.0.0a1 to 23.7.1 (through the newest release)
CVE-2024-45605
No published release is affected
No published release is affected
CVE-2024-45606
Affects 23.4.0 to 23.7.1 (through the newest release)
CVE-2024-41656
Affects 10.0.0 to 23.7.1 (through the newest release)
CVE-2024-35196
No published release is affected
No published release is affected
CVE-2024-32474
No published release is affected
No published release is affected
CVE-2023-39531
Affects 10.0.0 to 23.7.1 (through the newest release)
CVE-2023-39349
Affects 22.1.0 to 23.7.1 (through the newest release)

Show all 15 advisoriesShow fewer advisories

CVE-2023-36826
Affects 8.21.0 to 23.5.1 (23.5.2 is outside it)
CVE-2023-36829
Affects 23.6.0 to 23.6.1 (23.6.2 is outside it)
CVE-2022-23485
Affects 20.6.0 to 22.10.0 (22.11.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 15

CVE-2021-47935High 8.7
Sentry 8.2.0 Remote Code Execution via Pickle Deserialization
Affected: fixed in 8.1.4; from 8.2.0, fixed in 8.2.2; through 8.2.0.
Fixed in 8.2.2 (released Mar 4, 2016, 3719 days before disclosure).
The latest release, 23.7.1, is not affected.
CVE-2026-42354Critical 9.1
Sentry: Improper authentication on SAML SSO process allows user identity linking
Affected: from 21.12.0, fixed in 26.4.1.
No fix released. The advisory names 26.4.1 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected.
CVE-2026-27197Critical 9.1
Sentry: Improper Authentication on SAML SSO process allows user identity linking
Affected: from 21.12.0; from 21.12.0, fixed in 26.2.0.
No fix released. The latest release, 23.7.1, is still affected.
CVE-2025-22146Critical 9.1
Improper authentication on SAML SSO process allows user impersonation in sentry
Affected: from 21.12.0, fixed in 25.1.0.
No fix released. The advisory names 25.1.0 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected.
CVE-2024-53253Medium 5.3
Sentry's improper error handling leaks Application Integration Client Secret
Affected: from 24.11.0, fixed in 24.11.1; through 24.11.0.
No fix released. The advisory names 24.11.1 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected.
CVE-2024-45605Medium 6.5
Improper authorization on deletion of user issue alert notifications in sentry
Affected: from 23.9.0, fixed in 24.9.0.
No fix released. The advisory names 24.9.0 as the fix, which the registry doesn't have yet.
CVE-2024-45606High 7.1
Improper authorization on muting of alert rules in sentry
Affected: from 23.4.0, fixed in 24.9.0.
No fix released. The advisory names 24.9.0 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected.
CVE-2024-41656High 7.1
Sentry vulnerable to stored Cross-Site Scripting (XSS)
Affected: from 10.0.0, fixed in 24.7.1.
No fix released. The advisory names 24.7.1 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected.
CVE-2024-35196Low 2.0
Slack integration leaks sensitive information in logs in Sentry
Affected: from 24.3.0, fixed in 24.5.0.
No fix released. The advisory names 24.5.0 as the fix, which the registry doesn't have yet.
CVE-2024-32474High 7.3
Sentry's superuser cleartext password leaked in logs
Affected: from 24.3.0, fixed in 24.4.1.
No fix released. The advisory names 24.4.1 as the fix, which the registry doesn't have yet.
CVE-2023-39531Medium 6.5
Sentry vulnerable to incorrect credential validation on OAuth token requests
Affected: from 10.0.0, fixed in 23.7.2.
No fix released. The advisory names 23.7.2 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected.
CVE-2023-39349High 8.1
Sentry vulnerable to privilege escalation via ApiTokensEndpoint
Affected: from 22.1.0, fixed in 23.7.2.
No fix released. The advisory names 23.7.2 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected.
CVE-2023-36826High 7.7
Sentry vulnerable to improper authorization on debug and artifact file downloads
Affected: from 8.21.0, fixed in 23.5.2.
Fixed in 23.5.2 (released May 31, 2023, 55 days before disclosure).
The latest release, 23.7.1, is not affected.
CVE-2023-36829Medium 6.8
Sentry CORS misconfiguration vulnerability
Affected: from 23.6.0, fixed in 23.6.2.
Fixed in 23.6.2 (released Jul 6, 2023, the day of disclosure).
The latest release, 23.7.1, is not affected.
CVE-2022-23485Medium 6.4
Invite code reuse via cookie manipulation in sentry
Affected: from 20.6.0, fixed in 22.11.0.
Fixed in 22.11.0 (released Nov 15, 2022, 25 days before disclosure).
The latest release, 23.7.1, is not affected.