Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-111671

Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Data-infra
Products
Cube-studio
CVE-2026-111672

Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Data-infra
Products
Cube-studio