livebook records
6 published records for vendor livebook.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')2
- CWE-23 Relative Path Traversal1
- CWE-346 Origin Validation Error1
- CWE-352 Cross-Site Request Forgery (CSRF)1
- CWE-636 Not Failing Securely ('Failing Open')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
6 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2023-35174No exploit | Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windowslivebook · livebook · CWE-78 | Critical9.8 | — | 0.9% | Jun 22, 2023 |
34Monitor | CVE-2026-66298No exploit | JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcutslivebook · livebook · CWE-346 | High8.6 | — | 0.2% | Aug 5, 2026 |
30Monitor | CVE-2026-68746No exploit | Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated accesslivebook · livebook · CWE-636 | High7.7 | — | 0.8% | Aug 5, 2026 |
28Monitor | CVE-2026-66881No exploit | Path traversal in imported file_entries name allows arbitrary file write via URL-type entry downloadlivebook · livebook · CWE-23 | High7.0 | — | 0.6% | Aug 5, 2026 |
27Monitor | CVE-2026-66885No exploit | Livebook Teams identity callback lacks state binding, allowing login CSRFlivebook · livebook · CWE-352 | Medium6.8 | — | 0.2% | Aug 5, 2026 |
21Monitor | CVE-2026-66297No exploit | Unescaped deployment environment variables in generated setup commandslivebook · livebook · CWE-78 | Medium5.0 | — | 2.4% | Aug 5, 2026 |
- CVE-2023-3517439Monitor
Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows
CriticalCVSS 9.8No exploitEPSS 0%livebook · livebookJun 22, 2023
- CVE-2026-6629834Monitor
JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts
HighCVSS 8.6No exploitEPSS 0%livebook · livebookAug 5, 2026
- CVE-2026-6874630Monitor
Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access
HighCVSS 7.7No exploitEPSS 0%livebook · livebookAug 5, 2026
- CVE-2026-6688128Monitor
Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download
HighCVSS 7.0No exploitEPSS 0%livebook · livebookAug 5, 2026
- CVE-2026-6688527Monitor
Livebook Teams identity callback lacks state binding, allowing login CSRF
MediumCVSS 6.8No exploitEPSS 0%livebook · livebookAug 5, 2026
- CVE-2026-6629721Monitor
Unescaped deployment environment variables in generated setup commands
MediumCVSS 5.0No exploitEPSS 2%livebook · livebookAug 5, 2026