bugsink has 10 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The busiest recent month was June 2026 with 3. The median CVSS is 4.3 (medium), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.3
- Publish → KEV
- —
- Last 90 days
- 1 prev 4
Worst active — by depth score
CVE-2026-27614Critical· 9.3Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering51CVE-2025-64509High· 7.5Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)41CVE-2025-64508High· 7.5Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input41CVE-2025-54433HighBugsink path traversal via event_id in ingestion41CVE-2026-40162High· 7.1Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble39
bugsink vulnerabilities
CVEs affecting bugsink, newest first. Open any entry for full detail, references, and exploit status.
10 CVEsRSS
CVE-2026-53954Medium· 4.3Bugsink is a self-hosted error tracking tool
Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force exce…
CVE-2026-47715Low· 3.1Bugsink: Issue event views can show an event from another project if its UUID is known
Bugsink: Issue event views can show an event from another project if its UUID is known
CVE-2026-47716Low· 3.1Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
CVE-2026-47728Medium· 4.3Bugsink: Project scoping missing in sourcemap and debug-file lookup
Bugsink: Project scoping missing in sourcemap and debug-file lookup
CVE-2026-44502Medium· 4.3Bunsink has an SSRF bypass in `validate_webhook_url`
Bunsink has an SSRF bypass in `validate_webhook_url`
CVE-2026-40162High· 7.1Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble
Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble
CVE-2026-27614Critical· 9.3Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
CVE-2025-64509High· 7.5Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)
Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)
CVE-2025-64508High· 7.5Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input
Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input
CVE-2025-54433HighBugsink path traversal via event_id in ingestion
Bugsink path traversal via event_id in ingestion