bugsink vulnerabilities
CVEs whose affected-version data names the bugsink package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
9 CVEsRSS
CVE-2026-53954Medium· 4.3Bugsink is a self-hosted error tracking tool
Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force exce…
CVE-2026-47715Low· 3.1Bugsink: Issue event views can show an event from another project if its UUID is known
Bugsink: Issue event views can show an event from another project if its UUID is known
CVE-2026-47716Low· 3.1Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
CVE-2026-47728Medium· 4.3Bugsink: Project scoping missing in sourcemap and debug-file lookup
Bugsink: Project scoping missing in sourcemap and debug-file lookup
CVE-2026-44502Medium· 4.3Bunsink has an SSRF bypass in `validate_webhook_url`
Bunsink has an SSRF bypass in `validate_webhook_url`
CVE-2026-40162High· 7.1Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble
Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble
CVE-2025-64509High· 7.5Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)
Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)
CVE-2025-64508High· 7.5Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input
Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input
CVE-2025-54433HighBugsink path traversal via event_id in ingestion
Bugsink path traversal via event_id in ingestion