11 matches found
CVE-2026-73221 CVAT: Flawed authorization logic in endpoints related to lambda requests
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs t...
CVE-2026-57494
The CVE describes a cross‑agent task authorization bypass in AgenticMail. In @agenticmail/api versions before 0.9.64, a low‑privileged authenticated agent can enumerate another agent’s pending/claimed tasks via GET /api/agenticmail/tasks/pending?assignee=, receiving task IDs and payloads. Those I...
AgenticMail: Cross-agent task authorization bypass in AgenticMail API
Summary A low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the...
Apache Airflow 安全漏洞
Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. However, Apache Airflow has security vulnerabilities. The...
BIT-HARBOR-2024-22261 SQL Injection in Harbor scan log API
SQL-Injection in Harbor allows priviledge users to leak the task IDs...
EUVD-2024-2184
Malicious code in bioql PyPI...
CVE-2024-22261
SQL-Injection in Harbor allows priviledge users to leak the task IDs...
CVE-2024-22261: Authorization Bypass Through User-Controlled SQL Primary Key
SQL-Injection in Harbor allows priviledge users to leak the task IDs...
CVE-2024-22261 SQL Injection in Harbor scan log API
SQL-Injection in Harbor allows priviledge users to leak the task IDs...
