GHSA-6H3C-R723-7FX3 NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

Impact In versions from 1.5.0 up to and including 3.0.0, any authenticated portal user could complete and tamper with another user's open task by submitting it on their behalf. The task submission endpoint accepted a task ID and a payload, but it never checked whether the task actually belonged t...

CVE-2026-33619

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains a server-side request forgery issue in the optional scheduler's webhook delivery path. When a task is submitted to POST /tasks with a user-controlled callbackUrl, the v0.8.3...

PT-2026-27626

Name of the Vulnerable Software and Affected Versions PinchTab versions prior to 0.8.4 Description PinchTab includes an optional scheduler that, in version 0.8.3, had a server-side request forgery issue in its webhook delivery path. When a task is submitted to the POST /tasks endpoint with a...

Race Condition

Overview terra-notebook-utils is an Utilities for the Terra notebook environment. Affected versions of this package are vulnerable to Race Condition in task submission due to improper thread synchronization. The issue could lead to crashes or inconsistent task states when tasks are submitted from...