https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T05:18:07.018851+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-163209 EUVD-2026-163209 2026-10-09T05:18:07.020882+00:00 EUVD-2026-163209 https://cve.radiocsirt.org/vuln/fkie_cve-2024-6867 fkie_cve-2024-6867 2026-10-09T05:18:07.020918+00:00

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain information about non-public runs and their related runs, given the `run_id` of a public or non-public run.

 https://cve.radiocsirt.org/vuln/ghsa-9jmp-j63g-8x6m Withdrawn: GHSA-9jmp-j63g-8x6m — Withdrawn Advisory: Lunary information disclosure vulnerability 2026-10-09T05:18:07.020953+00:00

Withdrawn by the publisher.

Affected: npm: lunary

## Withdrawn Advisory This advisory has been withdrawn because the [lunary npm package](https://www.npmjs.com/package/lunary) is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory.

**The underlying vulnerability report is still valid**, but it doesn't affect a product in a [GitHub Advisory Database supported ecosystem](https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#github-reviewed-advisories).

This link is maintained to preserve external references.

## Original Description An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain information about non-public runs and their related runs, given the `run_id` of a public or non-public run.