Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/roundup@1.4.19
purl pkg:pypi/roundup@1.4.19
Next non-vulnerable version 2.5.0
Latest non-vulnerable version 2.5.0
Risk
Vulnerabilities affecting this package (10)
Vulnerability Summary Fixed by
VCID-1w67-ygzj-fugz
Aliases:
CVE-2014-6276
GHSA-j556-q367-2gw6
PYSEC-2016-33
schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.
1.5.1
Affected by 5 other vulnerabilities.
VCID-7kxe-bm1g-eyhe
Aliases:
CVE-2012-6131
GHSA-gw2q-cgvq-9g3v
PYSEC-2014-16
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1.
1.4.20
Affected by 6 other vulnerabilities.
VCID-9qv2-nkkm-53ae
Aliases:
CVE-2012-6130
GHSA-mccq-3m7h-fjxg
PYSEC-2014-15
Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link.
1.4.20
Affected by 6 other vulnerabilities.
VCID-9ydc-txfc-pqe6
Aliases:
CVE-2025-53865
GHSA-qxh9-qmf2-rhwc
PYSEC-2025-69
In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).
2.5.0
Affected by 0 other vulnerabilities.
VCID-agp7-u68t-abbe
Aliases:
CVE-2024-39124
GHSA-w8vc-cwv9-wx67
PYSEC-2024-63
In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.
2.4.0
Affected by 1 other vulnerability.
VCID-be33-dgsb-nycm
Aliases:
CVE-2019-10904
GHSA-926q-wxr6-3crq
PYSEC-2019-201
Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
2.0.0a0
Affected by 5 other vulnerabilities.
2.0.0
Affected by 4 other vulnerabilities.
VCID-m8r5-mtwf-cbgm
Aliases:
CVE-2024-39126
GHSA-x37x-qf4v-f54f
PYSEC-2024-65
Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
2.4.0
Affected by 1 other vulnerability.
VCID-rpbj-pyv7-3kag
Aliases:
CVE-2012-6132
GHSA-5v6q-xqq8-g4xj
PYSEC-2014-96
Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.
1.4.20
Affected by 6 other vulnerabilities.
VCID-yufw-2bru-h7h1
Aliases:
CVE-2024-39125
GHSA-xjgw-ghrx-wfff
PYSEC-2024-64
Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.
2.4.0
Affected by 1 other vulnerability.
VCID-zbqf-gvrf-m3fs
Aliases:
CVE-2012-6133
GHSA-5jq3-8437-x35p
PYSEC-2020-212
Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*.
1.4.20
Affected by 6 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-04T16:16:16.823399+00:00 PyPI Importer Affected by VCID-1w67-ygzj-fugz https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.6.0
2026-06-04T16:16:00.418167+00:00 PyPI Importer Affected by VCID-9qv2-nkkm-53ae https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.6.0
2026-06-04T16:16:00.314595+00:00 PyPI Importer Affected by VCID-7kxe-bm1g-eyhe https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.6.0
2026-06-04T16:16:00.207770+00:00 PyPI Importer Affected by VCID-rpbj-pyv7-3kag https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.6.0
2026-06-02T04:23:15.840511+00:00 Pypa Importer Affected by VCID-9ydc-txfc-pqe6 https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2025-69.yaml 38.6.0
2026-06-02T04:21:38.487297+00:00 Pypa Importer Affected by VCID-yufw-2bru-h7h1 https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2024-64.yaml 38.6.0
2026-06-02T04:21:38.182061+00:00 Pypa Importer Affected by VCID-m8r5-mtwf-cbgm https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2024-65.yaml 38.6.0
2026-06-02T04:21:37.864733+00:00 Pypa Importer Affected by VCID-agp7-u68t-abbe https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2024-63.yaml 38.6.0
2026-06-02T04:06:10.037393+00:00 Pypa Importer Affected by VCID-zbqf-gvrf-m3fs https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2020-212.yaml 38.6.0
2026-06-02T04:05:37.452948+00:00 Pypa Importer Affected by VCID-be33-dgsb-nycm https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2019-201.yaml 38.6.0
2026-06-02T04:04:11.090126+00:00 Pypa Importer Affected by VCID-1w67-ygzj-fugz https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2016-33.yaml 38.6.0
2026-06-02T04:03:32.365647+00:00 Pypa Importer Affected by VCID-7kxe-bm1g-eyhe https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2014-16.yaml 38.6.0
2026-06-02T04:03:32.108627+00:00 Pypa Importer Affected by VCID-9qv2-nkkm-53ae https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2014-15.yaml 38.6.0
2026-06-02T04:03:31.851120+00:00 Pypa Importer Affected by VCID-rpbj-pyv7-3kag https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2014-96.yaml 38.6.0