Lunary 1.4.9
Approved changes feed: RSS · Atom
cpe:2.3:a:lunary:lunary:1.4.9:*:*:*:*:*:*:*part: a version: 1.4.9 update: *
| Vendor | Lunary (d06a62eb-8728-5903-8388-539ff39c70e6) |
|---|---|
| Product | Lunary (8681bafc-d844-59ba-bfe1-ff3e7976ea73) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/lunary-ai/lunary |
purl2cpe | 2026-06-01 10:12:14.765591 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-6867 |
vulnerable | 2026-06-08 06:58:20.622415 |
Information Disclosure in lunary-ai/lunary
MEDIUM (4.3)
An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain information about non-public runs and their related runs, given the `run_id` of a public or non-public run.
Published: 2024-09-13T16:13:02.869Z
Updated: 2024-09-13T16:38:51.331Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.