411 matches found
CVE-2025-5352
CVE-2025-5352 В компоненте Analytics проекта lunary-ai/lunary обнаружена уязвимость, связанная с межсайтовым скриптингом XSS с сохранением. Проблема возникает из-за того, что переменная NEXTPUBLICCUSTOMSCRIPT внедряется непосредственно в DOM с помощью dangerouslySetInnerHTML без надлежащей...
CVE-2024-4147
In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations through ID manipulation. The vulnerability stems from the application's failure to validate the ownership of the prompt before deletion, on...
CVE-2024-4147
In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations through ID manipulation. The vulnerability stems from the application's failure to validate the ownership of the prompt before deletion, on...
CVE-2024-5386
In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerability is triggered when the 'viewer' role...
EUVD-2024-55392
In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerability is triggered when the 'viewer' role...
CVE-2024-5386: Excessive Attack Surface
In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerability is triggered when the 'viewer' role...
CVE-2024-4147: Insufficient Granularity of Access Control
In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations through ID manipulation. The vulnerability stems from the application's failure to validate the ownership of the prompt before deletion, on...
CVE-2025-9803
lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' audience field in the access token issued by Google, which is crucial for ensuring the token is intended for the...
CVE-2025-9803: Improper Authentication
lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' audience field in the access token issued by Google, which is crucial for ensuring the token is intended for the...
EUVD-2024-46907
Malicious code in bioql PyPI...
EUVD-2024-46513
Malicious code in bioql PyPI...
EUVD-2024-46383
Malicious code in bioql PyPI...
EUVD-2024-32334
Malicious code in bioql PyPI...
EUVD-2024-32090
Malicious code in bioql PyPI...
EUVD-2025-6879
Malicious code in bioql PyPI...
EUVD-2025-6897
Malicious code in bioql PyPI...
EUVD-2025-7064
Malicious code in bioql PyPI...
EUVD-2025-6950
Malicious code in bioql PyPI...