CVE-2026-111672

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/viewpipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copypipeline...

CVE-2026-111672 Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/viewpipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copypipeline...

EUVD-2026-102963

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/viewpipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copypipeline...

CVE-2026-111672

Cube-studio through version 2026.09.01 is affected by an Insecure Direct Object Reference (IDOR) vulnerability in the myapp/views/view_pipeline.py component. Due to a missing authorization check, authenticated users can view or copy pipelines belonging to other project groups by providing a speci...

PT-2026-116071

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy pipeline...

EUVD-2025-5996

Malicious code in bioql PyPI...

PT-2025-9905

Name of the Vulnerable Software and Affected Versions Ad Inserter - Ad Manager and AdSense Ads version 2.8.0 Description The issue arises from the web application dynamically generating web content without validating the source of potentially untrusted data in the file myapp/includes/dst/dst.php...

CVE-2025-0769: Deserialization of Untrusted Data

PixelYourSite - Your smart PIXEL TAG and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php...

CVE-2025-0767: Deserialization of Untrusted Data

WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php...

CVE-2025-22622: Improper Neutralization of Input During Web Page Generation

Age Verification for your checkout page. Verify your customer's identity 1.20.0 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/class-wc-integration-agechecker-integration.php...

MAL-2022-4753 Malicious code in myapp-by-7h3n00b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8305d7f0c460e41c74b5b2a6b311aaff28d6c91fb38e3ba4b7fd43f6f28fc2ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...