10 matches found
PT-2026-120290
Summary In affected versions, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned...
PT-2026-118611
Name of the Vulnerable Software and Affected Versions @modelcontextprotocol/sdk versions 1.24.0 through 1.31.0 Description The experimental tasks feature taskStore fails to verify which session created a specific task. Consequently, clients sharing a single InMemoryTaskStore can list, read, and...
Model Context Protocol MCP TypeScript SDK Authorization Vulnerability
The Model Context Protocol MCP TypeScript SDK versions from 1.24.0 to 1.32.0 have a security vulnerability. This vulnerability arises from the experimental task feature taskStore not checking the sessions used to create tasks. Clients sharing the same InMemoryTaskStore can potentially list, read,...
CVE-2026-70483
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/id cancelled a chat's in-flight tasks before checking whether the caller could delete that chat. Any authenticated user who knew another user's chat id could abort...
CVE-2026-64112 rbd: eliminate a race in lock_dwork draining on unmap
In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lockdwork draining on unmap Given how rbdlockaddrequest and rbdimgexclusivelock are written, lockdwork may be requeued more than it's actually needed: for example in case a new I/O request comes in while ...
CVE-2026-45399
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user with low privileges can enumerate active background tasks across the system and stop tasks belonging to other users via the GET /api/tasks and POST...
EUVD-2026-30608
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, any authenticated user with low privileges can enumerate active background tasks across the system and stop tasks belonging to other users via the GET /api/tasks and POST...
How to remove or cancel incomplete tasks in Citrix App Layering
This guide covers how to remove and cancel half finished and incomplete tasks in Citrix App Layering. For example, you may have deleted a packaging machine off of your hypervisor, but the action remains incomplete in the management console...
