# sentry (PyPI) vulnerabilities 15 known vulnerabilities (3 critical, 6 high, 5 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 23.7.1 (Jul 25, 2023): affected by 8 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 991 - Dependents: 0 - Releases: 371 since 2.0.0 (Jan 26, 2012) - Registry: https://pypi.org/project/sentry/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2021-47935: 2.0.0a1 to 8.2.1 (8.2.2 is outside it) - CVE-2026-42354: 21.12.0 to 23.7.1 (through the newest release) - CVE-2026-27197: 21.12.0 to 23.7.1 (through the newest release) - CVE-2025-22146: 21.12.0 to 23.7.1 (through the newest release) - CVE-2024-53253: 2.0.0a1 to 23.7.1 (through the newest release) - CVE-2024-45605: no published release is affected - CVE-2024-45606: 23.4.0 to 23.7.1 (through the newest release) - CVE-2024-41656: 10.0.0 to 23.7.1 (through the newest release) - CVE-2024-35196: no published release is affected - CVE-2024-32474: no published release is affected - CVE-2023-39531: 10.0.0 to 23.7.1 (through the newest release) - CVE-2023-39349: 22.1.0 to 23.7.1 (through the newest release) - CVE-2023-36826: 8.21.0 to 23.5.1 (23.5.2 is outside it) - CVE-2023-36829: 23.6.0 to 23.6.1 (23.6.2 is outside it) - CVE-2022-23485: 20.6.0 to 22.10.0 (22.11.0 is outside it) ## Advisories (15) ### [CVE-2021-47935](https://cve.now/CVE-2021-47935): Sentry 8.2.0 Remote Code Execution via Pickle Deserialization - Severity: High 8.7 - Published: May 10, 2026 - Affected: fixed in 8.1.4; from 8.2.0, fixed in 8.2.2; through 8.2.0. - Fixed in 8.2.2 (released Mar 4, 2016, 3719 days before disclosure). - The latest release, 23.7.1, is not affected. ### [CVE-2026-42354](https://cve.now/CVE-2026-42354): Sentry: Improper authentication on SAML SSO process allows user identity linking - Severity: Critical 9.1 - Published: May 8, 2026 - Affected: from 21.12.0, fixed in 26.4.1. - No fix released. The advisory names 26.4.1 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected. ### [CVE-2026-27197](https://cve.now/CVE-2026-27197): Sentry: Improper Authentication on SAML SSO process allows user identity linking - Severity: Critical 9.1 - Published: Feb 21, 2026 - Affected: from 21.12.0; from 21.12.0, fixed in 26.2.0. - No fix released. The latest release, 23.7.1, is still affected. ### [CVE-2025-22146](https://cve.now/CVE-2025-22146): Improper authentication on SAML SSO process allows user impersonation in sentry - Severity: Critical 9.1 - Published: Jan 15, 2025 - Affected: from 21.12.0, fixed in 25.1.0. - No fix released. The advisory names 25.1.0 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected. ### [CVE-2024-53253](https://cve.now/CVE-2024-53253): Sentry's improper error handling leaks Application Integration Client Secret - Severity: Medium 5.3 - Published: Nov 22, 2024 - Affected: from 24.11.0, fixed in 24.11.1; through 24.11.0. - No fix released. The advisory names 24.11.1 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected. ### [CVE-2024-45605](https://cve.now/CVE-2024-45605): Improper authorization on deletion of user issue alert notifications in sentry - Severity: Medium 6.5 - Published: Sep 17, 2024 - Affected: from 23.9.0, fixed in 24.9.0. - No fix released. The advisory names 24.9.0 as the fix, which the registry doesn't have yet. ### [CVE-2024-45606](https://cve.now/CVE-2024-45606): Improper authorization on muting of alert rules in sentry - Severity: High 7.1 - Published: Sep 17, 2024 - Affected: from 23.4.0, fixed in 24.9.0. - No fix released. The advisory names 24.9.0 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected. ### [CVE-2024-41656](https://cve.now/CVE-2024-41656): Sentry vulnerable to stored Cross-Site Scripting (XSS) - Severity: High 7.1 - Published: Jul 23, 2024 - Affected: from 10.0.0, fixed in 24.7.1. - No fix released. The advisory names 24.7.1 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected. ### [CVE-2024-35196](https://cve.now/CVE-2024-35196): Slack integration leaks sensitive information in logs in Sentry - Severity: Low 2.0 - Published: May 31, 2024 - Affected: from 24.3.0, fixed in 24.5.0. - No fix released. The advisory names 24.5.0 as the fix, which the registry doesn't have yet. ### [CVE-2024-32474](https://cve.now/CVE-2024-32474): Sentry's superuser cleartext password leaked in logs - Severity: High 7.3 - Published: Apr 18, 2024 - Affected: from 24.3.0, fixed in 24.4.1. - No fix released. The advisory names 24.4.1 as the fix, which the registry doesn't have yet. ### [CVE-2023-39531](https://cve.now/CVE-2023-39531): Sentry vulnerable to incorrect credential validation on OAuth token requests - Severity: Medium 6.5 - Published: Aug 9, 2023 - Affected: from 10.0.0, fixed in 23.7.2. - No fix released. The advisory names 23.7.2 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected. ### [CVE-2023-39349](https://cve.now/CVE-2023-39349): Sentry vulnerable to privilege escalation via ApiTokensEndpoint - Severity: High 8.1 - Published: Aug 7, 2023 - Affected: from 22.1.0, fixed in 23.7.2. - No fix released. The advisory names 23.7.2 as the fix, which the registry doesn't have yet. The latest release, 23.7.1, is still affected. ### [CVE-2023-36826](https://cve.now/CVE-2023-36826): Sentry vulnerable to improper authorization on debug and artifact file downloads - Severity: High 7.7 - Published: Jul 25, 2023 - Affected: from 8.21.0, fixed in 23.5.2. - Fixed in 23.5.2 (released May 31, 2023, 55 days before disclosure). - The latest release, 23.7.1, is not affected. ### [CVE-2023-36829](https://cve.now/CVE-2023-36829): Sentry CORS misconfiguration vulnerability - Severity: Medium 6.8 - Published: Jul 6, 2023 - Affected: from 23.6.0, fixed in 23.6.2. - Fixed in 23.6.2 (released Jul 6, 2023, the day of disclosure). - The latest release, 23.7.1, is not affected. ### [CVE-2022-23485](https://cve.now/CVE-2022-23485): Invite code reuse via cookie manipulation in sentry - Severity: Medium 6.4 - Published: Dec 10, 2022 - Affected: from 20.6.0, fixed in 22.11.0. - Fixed in 22.11.0 (released Nov 15, 2022, 25 days before disclosure). - The latest release, 23.7.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/sentry Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.