# rdiffweb (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/rdiffweb Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/rdiffweb.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 43 vulnerabilities in rdiffweb (PyPI): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2023-4138, was published on 7 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 43 (0 critical, 0 exploited in the wild) ## About rdiffweb (PyPI) A web interface for rdiff-backup repositories. ## Latest rdiffweb (PyPI) vulnerabilities - [CVE-2023-4138: PYSEC-2026-1863 - RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling](https://junglewise.ai/threats/cve-2023-4138-rdiffweb-vulnerable-to-allocation-of-resources-without-limits-or) (low, CVSS 3, published 7 Jul 2026) - [CVE-2025-67796: PYSEC-2026-3048 - IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users](https://junglewise.ai/threats/cve-2025-67796-ikus-rdiffweb-allows-an-attacker-with-any-valid-or-stolen-access) (high, CVSS 8.1, published 4 May 2026) - [CVE-2023-5289: PYSEC-2023-186 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.](https://junglewise.ai/threats/cve-2023-5289-rdiffweb-allocation-of-resources-without-limits-or-throttling) (low, CVSS 3.1, published 29 Sep 2023) - [CVE-2022-4720: PYSEC-2022-43006 - Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.](https://junglewise.ai/threats/cve-2022-4720-rdiffweb-vulnerable-to-open-redirect) (low, CVSS 3.1, published 27 Dec 2022) - [CVE-2022-4724: PYSEC-2022-43010 - Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.](https://junglewise.ai/threats/cve-2022-4724-rdiffweb-improper-access-control-vulnerability) (low, CVSS 3.1, published 27 Dec 2022) - [CVE-2022-4719: PYSEC-2022-43005 - Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.](https://junglewise.ai/threats/cve-2022-4719-rdiffweb-business-logic-errors) (low, CVSS 3, published 27 Dec 2022) - [CVE-2022-4722: PYSEC-2022-43008 - Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.](https://junglewise.ai/threats/cve-2022-4722-rdiffweb-vulnerable-to-authentication-bypass-by-primary-weakness) (low, CVSS 3.1, published 27 Dec 2022) - [CVE-2022-4723: PYSEC-2022-43009 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5.](https://junglewise.ai/threats/cve-2022-4723-rdiffweb-has-no-rate-limit-on-resend-email-feature) (low, CVSS 3.1, published 27 Dec 2022) - [CVE-2022-4721: rdiffweb vulnerable to Special Element Injection](https://junglewise.ai/threats/cve-2022-4721-rdiffweb-vulnerable-to-special-element-injection) (low, CVSS 3.1, published 27 Dec 2022) - [CVE-2022-4646: PYSEC-2022-43004 - Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4.](https://junglewise.ai/threats/cve-2022-4646-rdiffweb-vulnerable-to-cross-site-request-forgery) (low, CVSS 3.1, published 22 Dec 2022) - [CVE-2022-4644: PYSEC-2022-43003 - Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4.](https://junglewise.ai/threats/cve-2022-4644-rdiffweb-open-redirect-vulnerability) (low, CVSS 3.1, published 22 Dec 2022) - [CVE-2022-4314: PYSEC-2022-43002 - Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2.](https://junglewise.ai/threats/cve-2022-4314-improper-privilege-management-in-rdiffweb) (low, CVSS 3.1, published 12 Dec 2022) - [CVE-2022-4018: PYSEC-2022-43001 - Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.](https://junglewise.ai/threats/cve-2022-4018-rdiffweb-vulnerable-to-missing-authentication-for-critical) (low, CVSS 3.1, published 16 Nov 2022) - [CVE-2022-3362: PYSEC-2022-43000 - Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.](https://junglewise.ai/threats/cve-2022-3362-rdiffweb-vulnerable-to-insufficient-session-expiration) (low, CVSS 3.1, published 14 Nov 2022) - [CVE-2022-3363: PYSEC-2022-42978 - Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.](https://junglewise.ai/threats/cve-2022-3363-rdiffweb-subject-to-business-logic-errors) (low, CVSS 3.1, published 26 Oct 2022) - [CVE-2022-3327: PYSEC-2022-42977 - Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.](https://junglewise.ai/threats/cve-2022-3327-rdiffweb-is-missing-authentication-for-critical-function) (low, CVSS 3.1, published 20 Oct 2022) - [CVE-2022-3439: PYSEC-2022-43159 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.](https://junglewise.ai/threats/cve-2022-3439-missing-rate-limit-on-rdiffweb) (low, CVSS 3.1, published 14 Oct 2022) - [CVE-2022-3456: PYSEC-2022-43160 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.](https://junglewise.ai/threats/cve-2022-3456-missing-rate-limit-on-rdiffweb) (low, CVSS 3.1, published 13 Oct 2022) - [CVE-2022-3457: PYSEC-2022-43161 - Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.](https://junglewise.ai/threats/cve-2022-3457-origin-validation-error-in-rdiffweb) (low, CVSS 3.1, published 13 Oct 2022) - [CVE-2022-3438: PYSEC-2022-43158 - Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.](https://junglewise.ai/threats/cve-2022-3438-rdiffweb-vulnerable-to-open-redirect) (low, CVSS 3.1, published 10 Oct 2022) - [CVE-2022-3273: PYSEC-2022-43156 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to…](https://junglewise.ai/threats/cve-2022-3273-rdiffweb-does-not-have-a-rate-limit-on-incorrect-password-attempts) (low, CVSS 3.1, published 6 Oct 2022) - [CVE-2022-3389: PYSEC-2022-302 - Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10.](https://junglewise.ai/threats/cve-2022-3389-rdiffweb-path-traversal-vulnerability) (low, CVSS 3.1, published 6 Oct 2022) - [CVE-2022-3376: PYSEC-2022-43157 - Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.](https://junglewise.ai/threats/cve-2022-3376-rdiffweb-allows-a-new-password-to-be-the-same-as-the-previous) (low, CVSS 3.1, published 6 Oct 2022) - [CVE-2022-3371: PYSEC-2022-299 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.](https://junglewise.ai/threats/cve-2022-3371-rdiffweb-unvalidated-token-name-length-leads-to-dos) (low, CVSS 3.1, published 30 Sep 2022) - [CVE-2022-3364: PYSEC-2022-298 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.](https://junglewise.ai/threats/cve-2022-3364-rdiffweb-s-unlimited-length-fullname-field-can-lead-to-dos) (low, CVSS 3, published 29 Sep 2022) ## Most severe rdiffweb (PyPI) vulnerabilities - [CVE-2025-67796: PYSEC-2026-3048 - IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users](https://junglewise.ai/threats/cve-2025-67796-ikus-rdiffweb-allows-an-attacker-with-any-valid-or-stolen-access) (high, CVSS 8.1, published 4 May 2026) - [CVE-2022-3290: rdiffweb Denial of Service via unlimited username length](https://junglewise.ai/threats/cve-2022-3290-rdiffweb-denial-of-service-via-unlimited-username-length) (high, CVSS 7.5, published 27 Sep 2022) - [CVE-2022-3272: PYSEC-2022-291 - Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.](https://junglewise.ai/threats/cve-2022-3272-rdiffweb-s-unlimited-length-email-field-can-lead-to-dos) (low, CVSS 3.1, published 26 Sep 2022) - [CVE-2022-3167: PYSEC-2022-268 - Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.](https://junglewise.ai/threats/cve-2022-3167-rdiffweb-vulnerable-to-improper-restriction-of-rendered-ui-layers) (low, CVSS 3.1, published 8 Sep 2022) - [CVE-2022-3298: PYSEC-2022-294 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.](https://junglewise.ai/threats/cve-2022-3298-rdiffweb-vulnerable-to-potential-dos-via-memory-consumption) (low, CVSS 3.1, published 26 Sep 2022) - [CVE-2022-3295: PYSEC-2022-293 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.](https://junglewise.ai/threats/cve-2022-3295-rdiffweb-allows-unlimited-length-of-root-directory-name-which) (low, CVSS 3.1, published 26 Sep 2022) - [CVE-2022-4722: PYSEC-2022-43008 - Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.](https://junglewise.ai/threats/cve-2022-4722-rdiffweb-vulnerable-to-authentication-bypass-by-primary-weakness) (low, CVSS 3.1, published 27 Dec 2022) - [CVE-2022-3389: PYSEC-2022-302 - Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10.](https://junglewise.ai/threats/cve-2022-3389-rdiffweb-path-traversal-vulnerability) (low, CVSS 3.1, published 6 Oct 2022) - [CVE-2022-3371: PYSEC-2022-299 - Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.](https://junglewise.ai/threats/cve-2022-3371-rdiffweb-unvalidated-token-name-length-leads-to-dos) (low, CVSS 3.1, published 30 Sep 2022) - [CVE-2022-3179: PYSEC-2022-272 - Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.](https://junglewise.ai/threats/cve-2022-3179-rdiffweb-contains-weak-password-requirements) (low, CVSS 3.1, published 13 Sep 2022) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "rdiffweb (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/rdiffweb, 13 November 2026.