VulnerableCode Package Details - pkg:pypi/roundup@1.5.1

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:pypi/roundup@1.5.1

Essentials
History (7)

purl	pkg:pypi/roundup@1.5.1

Next non-vulnerable version	2.5.0
Latest non-vulnerable version	2.5.0
Risk

Vulnerabilities affecting this package (5)

Vulnerability	Summary	Fixed by
VCID-csmv-58s1-5bde Aliases: CVE-2019-10904 GHSA-926q-wxr6-3crq PYSEC-2019-201	Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.	2.0.0a0 Affected by 5 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 2.0.0 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-ntht-6gus-87cv Aliases: CVE-2025-53865 PYSEC-2025-69	In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).	2.5.0 Affected by 0 other vulnerabilities.
VCID-uk8q-2vzm-hbhu Aliases: CVE-2024-39126 GHSA-x37x-qf4v-f54f PYSEC-2024-65	Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.	2.4.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-wjqt-h4bh-gbgr Aliases: CVE-2024-39124 GHSA-w8vc-cwv9-wx67 PYSEC-2024-63	In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.	2.4.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-zk4h-xznt-n3c3 Aliases: CVE-2024-39125 GHSA-xjgw-ghrx-wfff PYSEC-2024-64	Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.	2.4.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (1)

Vulnerability	Summary	Aliases
VCID-fg7q-khn3-q7hr	schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.	CVE-2014-6276 GHSA-j556-q367-2gw6 PYSEC-2016-33

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-05-30T20:59:22.539590+00:00	GitLab Importer	Fixing	VCID-fg7q-khn3-q7hr	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/roundup/CVE-2014-6276.yml	38.6.0
2026-05-30T20:36:33.833725+00:00	Pypa Importer	Affected by	VCID-ntht-6gus-87cv	https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2025-69.yaml	38.6.0
2026-05-30T20:34:50.888849+00:00	Pypa Importer	Affected by	VCID-zk4h-xznt-n3c3	https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2024-64.yaml	38.6.0
2026-05-30T20:34:50.553392+00:00	Pypa Importer	Affected by	VCID-uk8q-2vzm-hbhu	https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2024-65.yaml	38.6.0
2026-05-30T20:34:50.226466+00:00	Pypa Importer	Affected by	VCID-wjqt-h4bh-gbgr	https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2024-63.yaml	38.6.0
2026-05-30T20:18:15.989904+00:00	Pypa Importer	Affected by	VCID-csmv-58s1-5bde	https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2019-201.yaml	38.6.0
2026-05-30T20:16:46.485600+00:00	Pypa Importer	Fixing	VCID-fg7q-khn3-q7hr	https://github.com/pypa/advisory-database/blob/main/vulns/roundup/PYSEC-2016-33.yaml	38.6.0