Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-53954 | Bugsink: DOS using large numbers of event tags | * | 4.3 | — | 2026-09-16 | |
| CVE-2026-47716 | Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known | * | 3.1 | — | 2026-05-27 | |
| CVE-2026-47715 | Bugsink: Issue event views can show an event from another project if its UUID is known | * | 3.1 | — | 2026-05-27 | |
| CVE-2026-47728 | Bugsink: Project scoping missing in sourcemap and debug-file lookup | * | 4.3 | — | 2026-05-27 | |
| CVE-2026-44502 | Bugsink: SSRF bypass in `validate_webhook_url` | * | 4.3 | — | 2026-05-27 | |
| CVE-2026-40162 | Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble | * | 7.1 | — | 2026-04-11 | |
| CVE-2026-27614 | Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering | * | 9.3 | — | 2026-02-25 | |
| CVE-2025-64509 | Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU) | * | 7.5 | — | 2025-11-11 | |
| CVE-2025-64508 | Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input | * | 7.5 | — | 2025-11-11 | |
| CVE-2025-54433 | Bugsink is vulnerable to Path Traversal attacks via event_id in ingestion | * | 7.2 | — | 2025-07-30 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).