CVE-2024-5386 | High | 8.8 | 2026-02-02 | In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this v… |
CVE-2024-4147 | Medium | 6.5 | 2026-02-02 | In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations t… |
CVE-2025-9803 | High | 8.8 | 2025-11-25 | lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to v… |
CVE-2025-5352 | Critical | 9.6 | 2025-08-23 | A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_C… |
CVE-2025-4962 | High | 7.7 | 2025-08-18 | An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8… |
CVE-2025-4779 | Medium | 6.1 | 2025-07-07 | lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into… |
CVE-2025-0281 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in lunary-ai/lunary versions 1.6.7 and earlier. An attacker can inject malicious JavaScript into the S… |
CVE-2024-9099 | High | 8.1 | 2025-03-20 | In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions… |
CVE-2024-9098 | Medium | 6.1 | 2025-03-20 | In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new members with billing permissions, thereby ga… |
CVE-2024-9096 | High | 7.1 | 2025-03-20 | In lunary-ai/lunary version 1.4.28, the /checklists/:id route allows low-privilege users to modify checklists by sending a PATCH request. The route lacks prope… |
CVE-2024-9095 | Critical | 9.8 | 2025-03-20 | In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-in user to create a Datastream to Google BigQuery… |
CVE-2024-9000 | Medium | 6.5 | 2025-03-20 | In lunary-ai/lunary before version 1.4.26, the checklists.post() endpoint allows users to create or modify checklists without validating whether the user has p… |
CVE-2024-8999 | High | 7.5 | 2025-03-20 | lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability all… |
CVE-2024-8998 | High | 7.5 | 2025-03-20 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. The server uses the regex /{.*?}/ to match user-co… |
CVE-2024-8789 | High | 7.5 | 2025-03-20 | Lunary-ai/lunary version git 105a3f6 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. The application allows users to upload their own r… |
CVE-2024-8765 | High | 7.3 | 2025-03-20 | In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as public if the path… |
CVE-2024-8764 | High | 7.5 | 2025-03-20 | A vulnerability in lunary-ai/lunary, as of commit be54057, allows users to upload and execute arbitrary regular expressions on the server side. This can lead t… |
CVE-2024-8763 | High | 7.5 | 2025-03-20 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary repository, specifically in the compileTextTemplate function. The a… |
CVE-2024-7476 | Medium | 4.3 | 2025-03-20 | A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any… |
CVE-2024-11301 | Medium | 6.5 | 2025-03-20 | In lunary-ai/lunary before version 1.6.3, the application allows the creation of evaluators without enforcing a unique constraint on the combination of project… |
CVE-2024-11300 | Medium | 6.5 | 2025-03-20 | In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can access prompt data of another user. This issue affec… |
CVE-2024-11137 | High | 7.5 | 2025-03-20 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the `PATCH /v1/runs/:id/score` endpoint of lunary-ai/lunary version 1.6.0. This vulnerabilit… |
CVE-2024-10762 | High | 8.1 | 2025-03-20 | In lunary-ai/lunary before version 1.5.9, the /v1/evaluators/ endpoint allows users to delete evaluators of a project by sending a DELETE request. However, the… |
CVE-2024-10330 | Medium | 6.5 | 2025-03-20 | In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluat… |
CVE-2024-10275 | High | 7.3 | 2025-03-20 | In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permi… |
CVE-2024-10274 | Medium | 6.5 | 2025-03-20 | An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5. The /users/me/org endpoint lacks adequate access control mechanisms, allowing… |
CVE-2024-10273 | Medium | 6.5 | 2025-03-20 | In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endp… |
CVE-2024-10272 | High | 7.5 | 2025-03-20 | lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of authorizatio… |
CVE-2024-3760 | High | 7.5 | 2024-11-14 | In lunary-ai/lunary version 1.2.7, there is a lack of rate limiting on the forgot password page, leading to an email bombing vulnerability. Attackers can explo… |
CVE-2024-3502 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently… |
CVE-2024-3501 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the respons… |
CVE-2024-3379 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged users to re-generate the private key for project… |
CVE-2024-7456 | Critical | 9.8 | 2024-11-01 | A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2. The `order by` clause of the SQL query uses `sql… |
CVE-2024-7475 | Critical | 9.1 | 2024-10-29 | An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without authorization. This vuln… |
CVE-2024-7474 | High | 8.1 | 2024-10-29 | In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external users by manipulating… |
CVE-2024-7473 | Medium | 6.5 | 2024-10-29 | An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2. This vulnerability allows an aut… |
CVE-2024-7472 | Medium | 6.5 | 2024-10-29 | lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign up API (/auth/sign… |
CVE-2024-6867 | Medium | 6.5 | 2024-09-13 | An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify tha… |
CVE-2024-6862 | High | 8.1 | 2024-09-13 | A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows a… |
CVE-2024-6582 | Medium | 4.3 | 2024-09-13 | A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Id… |
CVE-2024-6087 | Medium | 6.5 | 2024-09-13 | An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main branch. The vulnerability allows an attacker to… |
CVE-2024-6086 | Medium | 4.3 | 2024-06-27 | In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improper access control… |
CVE-2024-5755 | Medium | 5.3 | 2024-06-27 | In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the email address. This allows the creation o… |
CVE-2024-5714 | Medium | 6.8 | 2024-06-27 | In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate project identifiers i… |
CVE-2024-5389 | High | 8.1 | 2024-06-09 | In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variatio… |
CVE-2024-4146 | Critical | 9.8 | 2024-06-08 | In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an… |
CVE-2024-5478 | Medium | 6.1 | 2024-06-06 | A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata endpoint `/auth/saml/${org?.id}/metadata` of lunary-ai/lunary version 1.2.7. The vulnera… |
CVE-2024-5328 | Critical | 9.3 | 2024-06-06 | A Server-Side Request Forgery (SSRF) vulnerability exists in the lunary-ai/lunary application, specifically within the endpoint '/auth/saml/tto/download-idp-xm… |
CVE-2024-5248 | Medium | 6.5 | 2024-06-06 | In lunary-ai/lunary version 1.2.5, an improper access control vulnerability exists due to a missing permission check in the `GET /v1/users/me/org` endpoint. Th… |
CVE-2024-5133 | High | 8.1 | 2024-06-06 | In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, whe… |
CVE-2024-5131 | Medium | 6.5 | 2024-06-06 | An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to and including 1.2.2. The vulnerability allows unau… |
CVE-2024-5130 | High | 7.5 | 2024-06-06 | An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any datase… |
CVE-2024-5129 | High | 8.2 | 2024-06-06 | A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The… |
CVE-2024-5128 | High | 8.8 | 2024-06-06 | An Insecure Direct Object Reference (IDOR) vulnerability was identified in lunary-ai/lunary, affecting versions up to and including 1.2.2. This vulnerability a… |
CVE-2024-5126 | Medium | 6.5 | 2024-06-06 | An improper access control vulnerability exists in the lunary-ai/lunary repository, specifically within the versions.patch functionality for updating prompts… |
CVE-2024-5277 | High | 7.5 | 2024-06-06 | In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This… |
CVE-2024-5127 | Medium | 5.4 | 2024-06-06 | In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign th… |
CVE-2024-3504 | Medium | 6.5 | 2024-06-06 | An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the… |
CVE-2024-4148 | High | 7.5 | 2024-06-01 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerabi… |
CVE-2024-4154 | Medium | 6.5 | 2024-05-21 | In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to. Specific… |
CVE-2024-4151 | High | 8.1 | 2024-05-20 | An Improper Access Control vulnerability exists in lunary-ai/lunary version 1.2.2, where users can view and update any prompts in any projects due to insuffici… |
CVE-2024-3761 | High | 7.5 | 2024-05-20 | In lunary-ai/lunary version 1.2.2, the DELETE endpoint located at `packages/backend/src/api/v1/datasets` is vulnerable to unauthorized dataset deletion due to… |
CVE-2024-1739 | Critical | 9.1 | 2024-04-16 | lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fai… |
CVE-2024-1738 | High | 7.5 | 2024-04-16 | An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.get route in the evaluations API endpoi… |
CVE-2024-1666 | Medium | 5.3 | 2024-04-16 | In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side c… |
CVE-2024-1626 | High | 8.1 | 2024-04-16 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, within the project update endpoint. The vuln… |
CVE-2024-1902 | High | 7.5 | 2024-04-10 | lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerabili… |
CVE-2024-1741 | Critical | 9.1 | 2024-04-10 | lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an… |
CVE-2024-1740 | Critical | 9.1 | 2024-04-10 | In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using… |
CVE-2024-1643 | Critical | 9.1 | 2024-04-10 | By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organiza… |
CVE-2024-1625 | Medium | 6.5 | 2024-04-10 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organi… |