Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/roundup@1.4.16
purl pkg:pypi/roundup@1.4.16
Next non-vulnerable version 2.5.0
Latest non-vulnerable version 2.5.0
Risk
Vulnerabilities affecting this package (10)
Vulnerability Summary Fixed by
VCID-3tr4-c65w-fbay
Aliases:
CVE-2012-6132
PYSEC-2014-96
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
1.4.20
Affected by 6 other vulnerabilities.
VCID-bqn7-yjp5-6yf6
Aliases:
CVE-2012-6133
GHSA-5jq3-8437-x35p
PYSEC-2020-212
Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*.
1.4.20
Affected by 6 other vulnerabilities.
VCID-csmv-58s1-5bde
Aliases:
CVE-2019-10904
GHSA-926q-wxr6-3crq
PYSEC-2019-201
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
2.0.0a0
Affected by 5 other vulnerabilities.
2.0.0
Affected by 4 other vulnerabilities.
VCID-fg7q-khn3-q7hr
Aliases:
CVE-2014-6276
GHSA-j556-q367-2gw6
PYSEC-2016-33
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.
1.5.1
Affected by 5 other vulnerabilities.
VCID-mmv7-4kw7-kbex
Aliases:
CVE-2012-6131
GHSA-gw2q-cgvq-9g3v
PYSEC-2014-16
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1.
1.4.20
Affected by 6 other vulnerabilities.
VCID-ntht-6gus-87cv
Aliases:
CVE-2025-53865
PYSEC-2025-69
In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).
2.5.0
Affected by 0 other vulnerabilities.
VCID-uk8q-2vzm-hbhu
Aliases:
CVE-2024-39126
PYSEC-2024-65
Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
2.4.0
Affected by 1 other vulnerability.
VCID-wjqt-h4bh-gbgr
Aliases:
CVE-2024-39124
PYSEC-2024-63
In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.
2.4.0
Affected by 1 other vulnerability.
VCID-x33h-j6fk-g3hm
Aliases:
CVE-2012-6130
PYSEC-2014-15
Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.
1.4.20
Affected by 6 other vulnerabilities.
VCID-zk4h-xznt-n3c3
Aliases:
CVE-2024-39125
PYSEC-2024-64
Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.
2.4.0
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-30T20:36:33.805700+00:00 Pypa Importer Affected by VCID-ntht-6gus-87cv https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2025-69.yaml 38.6.0
2026-05-30T20:34:50.859436+00:00 Pypa Importer Affected by VCID-zk4h-xznt-n3c3 https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2024-64.yaml 38.6.0
2026-05-30T20:34:50.525483+00:00 Pypa Importer Affected by VCID-uk8q-2vzm-hbhu https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2024-65.yaml 38.6.0
2026-05-30T20:34:50.198941+00:00 Pypa Importer Affected by VCID-wjqt-h4bh-gbgr https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2024-63.yaml 38.6.0
2026-05-30T20:18:49.359407+00:00 Pypa Importer Affected by VCID-bqn7-yjp5-6yf6 https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2020-212.yaml 38.6.0
2026-05-30T20:18:15.963653+00:00 Pypa Importer Affected by VCID-csmv-58s1-5bde https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2019-201.yaml 38.6.0
2026-05-30T20:16:46.456000+00:00 Pypa Importer Affected by VCID-fg7q-khn3-q7hr https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2016-33.yaml 38.6.0
2026-05-30T20:16:07.152698+00:00 Pypa Importer Affected by VCID-mmv7-4kw7-kbex https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2014-16.yaml 38.6.0
2026-05-30T20:16:06.903396+00:00 Pypa Importer Affected by VCID-x33h-j6fk-g3hm https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2014-15.yaml 38.6.0
2026-05-30T20:16:06.645258+00:00 Pypa Importer Affected by VCID-3tr4-c65w-fbay https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2014-96.yaml 38.6.0