Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-119665

WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs

WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mgdaaslab
Products
Wharttest
CVE-2026-111617

WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mgdaaslab
Products
Wharttest