347 matches found
CVE-2025-5352
CVE-2025-5352 A stored Cross-Site Scripting XSS vulnerability has been identified in the Analytics component of lunary-ai/lunary. The issue arises because the NEXTPUBLICCUSTOMSCRIPT variable is injected directly into the DOM using dangerouslySetInnerHTML without proper sanitization or validation...
CVE-2024-4147
In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations through ID manipulation. The vulnerability stems from the application's failure to validate the ownership of the prompt before deletion, on...
CVE-2024-5386
In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerability is triggered when the 'viewer' role...
CVE-2024-4147
In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations through ID manipulation. The vulnerability stems from the application's failure to validate the ownership of the prompt before deletion, on...
EUVD-2024-55392
In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerability is triggered when the 'viewer' role...
CVE-2024-4147: Insufficient Granularity of Access Control
In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations through ID manipulation. The vulnerability stems from the application's failure to validate the ownership of the prompt before deletion, on...
CVE-2024-5386: Excessive Attack Surface
In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerability is triggered when the 'viewer' role...
CVE-2025-9803
lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' audience field in the access token issued by Google, which is crucial for ensuring the token is intended for the...
CVE-2025-9803: Improper Authentication
lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' audience field in the access token issued by Google, which is crucial for ensuring the token is intended for the...
EUVD-2025-6814
Malicious code in bioql PyPI...
EUVD-2024-32090
Malicious code in bioql PyPI...
EUVD-2024-32334
Malicious code in bioql PyPI...
EUVD-2024-31968
Malicious code in bioql PyPI...
EUVD-2024-46387
Malicious code in bioql PyPI...
EUVD-2024-46383
Malicious code in bioql PyPI...
EUVD-2024-2885
Malicious code in bioql PyPI...
EUVD-2025-7041
Malicious code in bioql PyPI...
EUVD-2025-7064
Malicious code in bioql PyPI...