Skip to content
OpenAdvisories

Vendor

mljar

4 known vulnerabilities.

mljar at a glance

Last 12 months
3
Critical · all time
3
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 3 vulnerabilities, 2 critical November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202632
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202511
Feb 202500
Jan 202500
Dec 202400

Products

mercury 3 PlotAI 1
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 6.1
    CVE-2026-111059

    Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

    Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Even…

    mljar mercury mercury PyPI
  • Critical 9.8
    CVE-2026-111058 Public exploit

    Mercury: Unauthenticated Remote Code Execution via /api/kernels

    Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The …

    mljar mercury mercury PyPI
  • Critical 10.0
    CVE-2026-111057

    Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

    Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals theref…

    mljar mercury mercury PyPI
  • Critical 9.3
    CVE-2025-1497

    Remote Code Execution in PlotAI

    A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor commented out vulnerable line, further usage of the software requi…

    mljar PlotAI plotai PyPI